Changeset 59515

Timestamp:

12/14/2024 11:51:09 PM (3 months ago)

Author:

SergeyBiryukov

Message:

Formatting: Check the result of preg_split() in convert_smilies().

This aims to avoid a fatal error from count() when preg_split() fails on large input.

Includes:

• Optimizing the regular expression used to split the input by tags to avoid unlimited backtracking for better performance.
• Adjusting the function logic for better readability.

Follow-up to [340], [4380], [26191].

Props podpirate, nathkrill, rajinsharwar, dmsnell, bjorsch, q0rban, audrasjb, rupw, Ov3rfly, jorbin, nhrrob, chaion07, mcqueen22, azaozz, narenin, roybellingan, SergeyBiryukov.
See #51019.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (1 diff)
• tests/phpunit/tests/formatting/convertSmilies.php (modified) (1 diff)

trunk/src/wp-includes/formatting.php

@@ -3474 +3474 @@
 function convert_smilies( $text ) {
     global $wp_smiliessearch;
+
+    if ( ! get_option( 'use_smilies' ) || empty( $wp_smiliessearch ) ) {
+        // Return default text.
+        return $text;
+    }
+
+    // HTML loop taken from texturize function, could possible be consolidated.
+    $textarr = preg_split( '/(<[^>]*>)/U', $text, -1, PREG_SPLIT_DELIM_CAPTURE ); // Capture the tags as well as in between.
+
+    if ( false === $textarr ) {
+        // Return default text.
+        return $text;
+    }
+
+    // Loop stuff.
+    $stop   = count( $textarr );
     $output = '';
-    if ( get_option( 'use_smilies' ) && ! empty( $wp_smiliessearch ) ) {
-        // HTML loop taken from texturize function, could possible be consolidated.
-        $textarr = preg_split( '/(<.*>)/U', $text, -1, PREG_SPLIT_DELIM_CAPTURE ); // Capture the tags as well as in between.
-        $stop    = count( $textarr ); // Loop stuff.
-
-        // Ignore processing of specific tags.
-        $tags_to_ignore       = 'code|pre|style|script|textarea';
-        $ignore_block_element = '';
-
-        for ( $i = 0; $i < $stop; $i++ ) {
-            $content = $textarr[ $i ];
-
-            // If we're in an ignore block, wait until we find its closing tag.
-            if ( '' === $ignore_block_element && preg_match( '/^<(' . $tags_to_ignore . ')[^>]*>/', $content, $matches ) ) {
-                $ignore_block_element = $matches[1];
-            }
-
-            // If it's not a tag and not in ignore block.
-            if ( '' === $ignore_block_element && strlen( $content ) > 0 && '<' !== $content[0] ) {
-                $content = preg_replace_callback( $wp_smiliessearch, 'translate_smiley', $content );
-            }
-
-            // Did we exit ignore block?
-            if ( '' !== $ignore_block_element && '</' . $ignore_block_element . '>' === $content ) {
-                $ignore_block_element = '';
-            }
-
-            $output .= $content;
-        }
-    } else {
-        // Return default text.
-        $output = $text;
-    }
+
+    // Ignore processing of specific tags.
+    $tags_to_ignore       = 'code|pre|style|script|textarea';
+    $ignore_block_element = '';
+
+    for ( $i = 0; $i < $stop; $i++ ) {
+        $content = $textarr[ $i ];
+
+        // If we're in an ignore block, wait until we find its closing tag.
+        if ( '' === $ignore_block_element && preg_match( '/^<(' . $tags_to_ignore . ')[^>]*>/', $content, $matches ) ) {
+            $ignore_block_element = $matches[1];
+        }
+
+        // If it's not a tag and not in ignore block.
+        if ( '' === $ignore_block_element && strlen( $content ) > 0 && '<' !== $content[0] ) {
+            $content = preg_replace_callback( $wp_smiliessearch, 'translate_smiley', $content );
+        }
+
+        // Did we exit ignore block?
+        if ( '' !== $ignore_block_element && '</' . $ignore_block_element . '>' === $content ) {
+            $ignore_block_element = '';
+        }
+
+        $output .= $content;
+    }
+
     return $output;
 }

trunk/tests/phpunit/tests/formatting/convertSmilies.php

@@ -394 +394 @@
         return $wpsmiliestrans;
     }
+
+
+    /**
+     * Tests that the function does not throw a fatal error from count()
+     * when preg_split() fails on large input.
+     *
+     * @ticket 51019
+     */
+    public function test_smilies_with_large_text_input() {
+        $text = '<p><img alt="" src="data:image/png;base64,' . str_repeat( 'iVBORw0KGgoAAAAN', 65536 ) . '="></p> :)';
+        $this->assertStringContainsString( "\xf0\x9f\x99\x82", convert_smilies( $text ) );
+    }
 }