Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure valid HTML is properly processed by refining regex handling #5697

Closed
wants to merge 5 commits into from
Closed

Ensure valid HTML is properly processed by refining regex handling #5697

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d1fd2a4
fix regex for html tag split in wptexturize
co6x0 Nov 22, 2023
0b14472
refactor attribute regex, add attribute regex to get_html_split_regex()
co6x0 Nov 22, 2023
3e9aa12
add tests for 'greater than' in html attribute value
co6x0 Nov 22, 2023
6879be1
fix bug of attribute regex in some cases, add test for that cases
co6x0 Nov 22, 2023
8940e5c
remove reference transformation process for '&' entities in html attr…
co6x0 Nov 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 35 additions & 14 deletions src/wp-includes/formatting.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,10 +249,6 @@ function wptexturize( $text, $reset = false ) {
continue;
} else {
// This is an HTML element delimiter.

// Replace each & with & unless it already looks like an entity.
$curl = preg_replace( '/&(?!#(?:\d+|x[a-f0-9]+);|[a-z1-4]{1,8};)/i', '&', $curl );

_wptexturize_pushpop_element( $curl, $no_texturize_tags_stack, $no_texturize_tags );
}
} elseif ( '' === trim( $curl ) ) {
Expand Down Expand Up @@ -657,13 +653,24 @@ function get_html_split_regex() {
. $cdata
. ')';

$ignore_attr =
'(?:'
. '[^>"\']*' // Match any characters except >, " or '.
. '(?:'
. '"[^"]*"' // Double-quoted attribute value.
. '|'
. '\'[^\']*\'' // Single-quoted attribute value.
. ')?'
. ')*'; // End of attribute value.

$regex =
'/(' // Capture the entire match.
. '<' // Find start of element.
. '(?' // Conditional expression follows.
. $escaped // Find end of escaped element.
. '|' // ...else...
. '[^>]*>?' // Find end of normal element.
'/(' // Capture the entire match.
. '<' // Find start of element.
. '(?' // Conditional expression follows.
. $escaped // Find end of escaped element.
. '|' // ...else...
. $ignore_attr // Exclude matching within attribute values.
. '[^>]*>?' // Find end of normal element.
. ')'
. ')/';
// phpcs:enable
Expand Down Expand Up @@ -696,12 +703,26 @@ function _get_wptexturize_split_regex( $shortcode_regex = '' ) {
. ')*+' // Loop possessively.
. '(?:-->)?'; // End of comment. If not found, match all input.

/**
* @see https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
*/
$ignore_attr_regex =
'(?:'
. '[^>"\']*' // Match any characters except >, " or '.
. '(?:'
. '"[^"]*"' // Double-quoted attribute value.
. '|'
. '\'[^\']*\'' // Single-quoted attribute value.
. ')?'
. ')*'; // End of attribute value.

$html_regex = // Needs replaced with wp_html_split() per Shortcode API Roadmap.
'<' // Find start of element.
. '(?(?=!--)' // Is this a comment?
. $comment_regex // Find end of comment.
'<' // Find start of element.
. '(?(?=!--)' // Is this a comment?
. $comment_regex // Find end of comment.
. '|'
. '[^>]*>?' // Find end of element. If not found, match all input.
. $ignore_attr_regex // Ignore matching of element end within attribute values.
. '[^>]*>?' // Find end of element. If not found, match all input.
. ')';
// phpcs:enable
}
Expand Down
18 changes: 18 additions & 0 deletions tests/phpunit/tests/formatting/wpHtmlSplit.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,24 @@ public function data_basic_features() {
'abcd <![CDATA[ <html> ]]> efgh',
array( 'abcd ', '<![CDATA[ <html> ]]>', ' efgh' ),
),
array(
'abcd <input placeholder="foo>bar" /> efgh',
array( 'abcd ', '<input placeholder="foo>bar" />', ' efgh' ),
),
array(
'abcd <input placeholder=\'foo>bar\' /> efgh',
array( 'abcd ', '<input placeholder=\'foo>bar\' />', ' efgh' ),
),
array(
'<p foo="" bar="2 > 1">numbers</p>',
array(
'',
'<p foo="" bar="2 > 1">',
'numbers',
'</p>',
'',
),
),
);
}

Expand Down
47 changes: 45 additions & 2 deletions tests/phpunit/tests/formatting/wpTexturize.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1278,11 +1278,11 @@ public function data_tag_avoidance() {
),
array(
'[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy & that guy </a> ]',
'[ photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy &#038; that guy </a> ]',
'[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy &#038; that guy </a> ]',
),
array(
'[photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy & that guy </a>]',
'[photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy &#038; that guy </a>]',
'[photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy &#038; that guy </a>]',
),
array(
'& <script>&&</script>',
Expand Down Expand Up @@ -2115,4 +2115,47 @@ public function data_whole_posts() {
require_once DIR_TESTDATA . '/formatting/whole-posts.php';
return data_whole_posts();
}

/**
* @ticket 43457
* @ticket 45387
* @ticket 57381
* @dataProvider data_greater_than_in_attribute_value
*/
public function test_greater_than_in_attribute_value( $input, $output ) {
$this->assertSame( $output, wptexturize( $input ) );
}

public function data_greater_than_in_attribute_value() {
return array(
array(
'
<label class="[&>span]:font-bold">"foo" or "bar"</label>
<input placeholder="foo<->bar" />
',
'
<label class="[&>span]:font-bold">&#8220;foo&#8221; or &#8220;bar&#8221;</label>
<input placeholder="foo<->bar" />
',
),
array(
'
<label class=\'[&>span]:font-bold\'>\'foo\' or \'bar\'</label>
<input placeholder=\'foo<->bar\' />
',
'
<label class=\'[&>span]:font-bold\'>&#8216;foo&#8217; or &#8216;bar&#8217;</label>
<input placeholder=\'foo<->bar\' />
',
),
array(
'<span data-content="<p>abcd</p>">loading...</span>',
'<span data-content="<p>abcd</p>">loading&#8230;</span>',
),
array(
'<p>Go to <a href="https://wordpress.org" target="_blank" rel="noreferrer noopener" aria-label="WordPress ->">WordPress -></a></p>',
'<p>Go to <a href="https://wordpress.org" target="_blank" rel="noreferrer noopener" aria-label="WordPress ->">WordPress -></a></p>',
),
);
}
}
Loading