[wp-trac] [WordPress Trac] #33102: Shortcodes with Quoted Attributes Break Inside of Quoted HTML Attributes

[WordPress Trac]

#33102: Shortcodes with Quoted Attributes Break Inside of Quoted HTML Attributes
--------------------------+------------------------------
 Reporter:  cgrymala      |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Shortcodes    |     Version:  4.2.3
 Severity:  normal        |  Resolution:
 Keywords:  needs-patch   |     Focuses:
--------------------------+------------------------------

Comment (by cgrymala):

 Okay, I've narrowed it down to the wp_kses_hair_parse() function. It's
 parsing the HTML string as having incorrect attributes because it's
 stopping at the first quote inside the shortcode.

 The way it's parsing it, it ends up thinking the HTML code breaks down
 like:

 `<a `
 `title="This is a test"`
 `href="/[currenturl sanitize=1 before="`
 `?ref="]"`
 `>`

 The solution seems to be to adjust the regex that parses the HTML tag
 looking for attributes. I'm open for ideas on how that might work, as I'm
 struggling with how to get the regex to tell the difference between a
 closing quote for the HTML attribute and an opening quote for a shortcode
 attribute.

 Bottom-line, is, though, that we need some way for the regex to determine
 which quotes are wrapping the HTML attribute value, and which quotes are
 inside the HTML attribute value.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/33102#comment:9>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform