Changeset 52153

Timestamp:

11/13/2021 07:26:52 AM (3 years ago)

Author:

westonruter

Message:

Embeds: Fix parsing of post embeds in wp_filter_oembed_result() by appending wp-embed script instead of prepending it in get_post_embed_html().

Due to the way that the blockquote and iframe are being parsed with a regular expression in wp_filter_oembed_result(), if there is any content at all before the blockquote start tag then it will fail to be included in the first matching group. By appending the wp-embed script instead of prepending it in get_post_embed_html(), then the parsing issue is avoided.

Also use non-greedy match wp_maybe_enqueue_oembed_host_js().

Amends [52132].
Fixes #44632.

Location:

trunk

Files:

• src/wp-includes/embed.php (modified) (3 diffs)
• tests/phpunit/tests/oembed/template.php (modified) (1 diff)

trunk/src/wp-includes/embed.php

@@ -375 +375 @@
  */
 function wp_maybe_enqueue_oembed_host_js( $html ) {
-    if ( preg_match( '/<blockquote\s[^>]*wp-embedded-content/', $html ) ) {
+    if ( preg_match( '/<blockquote\s[^>]*?wp-embedded-content/', $html ) ) {
         wp_enqueue_script( 'wp-embed' );
     }
@@ -472 +472 @@
     $embed_url .= "#?secret={$secret}";
 
-    $output = wp_get_inline_script_tag(
-        file_get_contents( ABSPATH . WPINC . '/js/wp-embed' . wp_scripts_get_suffix() . '.js' )
-    );
-
-    $output .= sprintf(
+    $output = sprintf(
         '<blockquote class="wp-embedded-content" data-secret="%1$s"><a href="%2$s">%3$s</a></blockquote>',
         esc_attr( $secret ),
@@ -497 +493 @@
         ),
         esc_attr( $secret )
+    );
+
+    // Note that the script must be placed after the <blockquote> and <iframe> due to a regexp parsing issue in
+    // `wp_filter_oembed_result()`. Because of the regex pattern starts with `|(<blockquote>.*?</blockquote>)?.*|`
+    // wherein the <blockquote> is marked as being optional, if it is not at the beginning of the string then the group
+    // will fail to match and everything will be matched by `.*` and not included in the group. This regex issue goes
+    // back to WordPress 4.4, so in order to not break older installs this script must come at the end.
+    $output .= wp_get_inline_script_tag(
+        file_get_contents( ABSPATH . WPINC . '/js/wp-embed' . wp_scripts_get_suffix() . '.js' )
     );
 

trunk/tests/phpunit/tests/oembed/template.php

@@ -301 +301 @@
         $actual   = preg_replace( '/secret=("?)\w+\1/', 'secret=__SECRET__', $actual );
 
-        $this->assertStringEndsWith( $expected, $actual );
+        $this->assertStringStartsWith( '<blockquote class="wp-embedded-content" data-secret=__SECRET__>', $actual );
+        $this->assertStringContainsString( $expected, $actual );
+        $this->assertStringEndsWith( '</script>', trim( $actual ) );
     }