Changeset 36036

Timestamp:

12/21/2015 02:42:30 AM (9 years ago)

Author:

pento

Message:

Texturize: Transform & into & in tag attributes.

[35709] was overly broad, and stopped transforming & characters within tag attributes. So that sites aren't generating invalid HTML, we need to restore this functionality, while continuing to not transform & within blocked tags.

Fixes #35008 for trunk.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (1 diff)
• tests/phpunit/tests/formatting/WPTexturize.php (modified) (2 diffs)

trunk/src/wp-includes/formatting.php

@@ -234 +234 @@
             } else {
                 // This is an HTML element delimiter.
+
+                // Replace each & with & unless it already looks like an entity.
+                $curl = preg_replace( '/&(?!#(?:\d+|x[a-f0-9]+);|[a-z1-4]{1,8};)/i', '&', $curl );
+
                 _wptexturize_pushpop_element( $curl, $no_texturize_tags_stack, $no_texturize_tags );
             }

trunk/tests/phpunit/tests/formatting/WPTexturize.php

@@ -11 +11 @@
 
     function test_disable() {
-        $this->assertEquals('<pre>---</pre>', wptexturize('<pre>---</pre>'));
-        $this->assertEquals('<pre><code></code>--</pre>', wptexturize('<pre><code></code>--</pre>'));
-
-        $this->assertEquals( '<code>---</code>',     wptexturize( '<code>---</code>'     ) );
-        $this->assertEquals( '<kbd>---</kbd>',       wptexturize( '<kbd>---</kbd>'       ) );
-        $this->assertEquals( '<style>---</style>',   wptexturize( '<style>---</style>'   ) );
-        $this->assertEquals( '<script>---</script>', wptexturize( '<script>---</script>' ) );
-        $this->assertEquals( '<tt>---</tt>',         wptexturize( '<tt>---</tt>'         ) );
+        $this->assertEquals('<pre>---&</pre>', wptexturize('<pre>---&</pre>'));
+        $this->assertEquals('<pre><code></code>--&</pre>', wptexturize('<pre><code></code>--&</pre>'));
+
+        $this->assertEquals( '<code>---&</code>',     wptexturize( '<code>---&</code>'     ) );
+        $this->assertEquals( '<kbd>---&</kbd>',       wptexturize( '<kbd>---&</kbd>'       ) );
+        $this->assertEquals( '<style>---&</style>',   wptexturize( '<style>---&</style>'   ) );
+        $this->assertEquals( '<script>---&</script>', wptexturize( '<script>---&</script>' ) );
+        $this->assertEquals( '<tt>---&</tt>',         wptexturize( '<tt>---&</tt>'         ) );
 
         $this->assertEquals('<code>href="baba"</code> &#8220;baba&#8221;', wptexturize('<code>href="baba"</code> "baba"'));
@@ -1269 +1269 @@
             array(
                 '[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy & that guy </a> ]',
-                '[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy &#038; that guy </a> ]',
+                '[ photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy &#038; that guy </a> ]',
             ),
             array(
                 '[photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy & that guy </a>]',
-                '[photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy &#038; that guy </a>]',
+                '[photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy &#038; that guy </a>]',
+            ),
+            array(
+                '& <script>&&</script>',
+                '&#038; <script>&&</script>'
             ),
             array(