wp_targeted_link_rel corrupts JSON content

[TobiasBg]

In [43732], via #43187, a wp_targeted_link_rel callback was added to filter content before it's saved to the database.

This has broken and ​corrupted JSON data in the TablePress plugin. (TablePress uses a CPT in which it stores a JSON-encoded two-dimensional array.)

If a cell of that array contains a link with a target attribute, like
<a href="https://example.com/" target="_blank">link</a>,
this gets converted and saved as
<a href=\"https://example.com/\" target=\"_blank\" rel="noopener noreferrer">link</a>
with the rel="noopener noreferrer" attribute being added but without espacing of ". This results in the JSON being invalid when read again.

This already caused problems for core, in #45292, with the result of the filter being removed temporarily via [44714].

I could apply the same "fix" around the saving process in TablePress, however the issue also appears to native core screens of the CPT. Also, as this feature is somewhat security-related, and turning it off would not be the favorable choice.

I strongly assume that this also affects other places where stored JSON code (with HTML code for a link inside) is handled by wp_targeted_link_rel.

[TobiasBg]

Related: #46321

[TobiasBg]

Could the regex that searches for target attributes be changed to only find those with " but not \" (JSON encoded) quotation marks around the attribute value?

[birgire]

What about using the same delimiter for the injected rel attribute, as for the existing target attribute, i.e. if we have target=\"_blank\" then add rel=\"noopener noreferrer\", else rel="noopener noreferrer"?

This is the approach in 46316.diff​.

[SergeyBiryukov]

Related: #47244

[SergeyBiryukov]

In 45348:

Formatting: Adjust wp_targeted_link_rel() to ensure JSON format is preserved and correct quotes are used when adding the missing rel attribute.

Props birgire, TobiasBg, fierevere, audrasjb, SergeyBiryukov.
Fixes #46316, #47244.

[SergeyBiryukov]

In 45349:

Formatting: Adjust wp_targeted_link_rel() to ensure JSON format is preserved and correct quotes are used when adding the missing rel attribute.

Props birgire, TobiasBg, fierevere, audrasjb, SergeyBiryukov.
Merges [45348] to the 5.2 branch.
Fixes #46316, #47244.