[wp-trac] [WordPress Trac] #28564: Shortcode Attributes with HTML Tags no longer working

[WordPress Trac]

#28564: Shortcode Attributes with HTML Tags no longer working
------------------------------------------+-----------------------------
 Reporter:  baden03                       |       Owner:  wonderboymusic
     Type:  defect (bug)                  |      Status:  reopened
 Priority:  high                          |   Milestone:  4.0
Component:  Formatting                    |     Version:  trunk
 Severity:  major                         |  Resolution:
 Keywords:  has-patch commit wptexturize  |     Focuses:
------------------------------------------+-----------------------------

Comment (by kitchin):

 Here's a different issue, not necessarily well-defined or well-covered by
 tests. The new regex is more greedy than it looks at first glance:

 formatting.php line 206
 {{{
 .       '(?:'
 .               '[^\[\]<>]'     // Shortcodes do not contain other
 shortcodes.
 .       '|'
 .               '<.+?>' // HTML elements permitted. Prevents matching ]
 before >.
 .       ')+'
 }}}
 and the corresponding line 232:
 {{{
 } elseif ( '[' === $first && 1 === preg_match(
 '/^\[\[?(?:[^\[\]<>]|<.+?>)+\]\]?$/', $curl ) ) {
         // This is an escaped shortcode delimeter.

         // Do not texturize.
 }}}
 The intent is surely to match brackets only within html tags. However it
 also matches brackets when any html tag is present. That's becuase `<.+?>`
 will go back and try to match as if `<.+>`.

 So all the following tests pass, including the unintended third one:
 {{{
 array(
         '[ do texturize "[quote]" here ]',
         '[ do texturize “[quote]” here ]',
 ),
 array(
         '[ regex catches this <a href="[quote]">here</a> ]',
         '[ regex catches this <a href="[quote]">here</a> ]',
 ),

 array(
         '[ but also catches the <b>styled "[quote]" here</b> ]',
         '[ but also catches the <b>styled "[quote]" here</b> ]',
 ),
 }}}
 You can drop them into tests/phpunit/tests/formatting/WPTexturize.php line
 1609 to see, though I tested without the full harness.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/28564#comment:25>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform