WordPress.org

Make WordPress Core

Opened 4 years ago

Last modified 4 months ago

#34814 new defect (bug)

Presence of "Less than sign" < adds additional closing shortcode tag.

Reported by: alexander.rohmann Owned by:
Milestone: Priority: normal
Severity: normal Version: 4.2.3
Component: Shortcodes Keywords:
Focuses: Cc:
PR Number:

Description (last modified by SergeyBiryukov)

If a < is used in shortcode content without a reciprocating > the shortcode closing tag will be duplicated. This was introduced in 4.2.3 as part of [33360].

For example, assuming [my_shortcode] simply returns it's content. This...
[my_shortcode]One < Two[/my_shortcode]

Should output this:
One < Two

But instead, we get this:

One < Two[/my_shortcode]

Consequently, a unit test somewhat like this won't pass:

array( 
    '[caption]Hello < World[/caption]', 
    'Hello < World'
)

I'm not 100% sure, but I suspect it's due to this regex:
https://core.trac.wordpress.org/browser/branches/4.2/src/wp-includes/shortcodes.php?rev=33360#L346

By continuing to match all input, perhaps that also grabs the shortcode's closing tag, causing it to be duplicated.

Change History (2)

#1 @SergeyBiryukov
4 years ago

  • Description modified (diff)

#2 @alexander.rohmann
4 years ago

Pardon if I missed the ability to update the title, but I'm realizing it's less than accurate. The closing tag isn't being duplicated, it's just being output as plaintext, and the shortcode renders as if $content wasn't provided. This can probably just be closed. It's more an issue of using raw < symbols in content instead of HTML entities. Because the markup is already invalid it may not be worth updating the shortcode parser to accommodate.

Note: See TracTickets for help on using tickets.