vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-07 09:49:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

The joys of wptexturize():

Browse Source 
* Revert parts of [28773] and [28727] and [29748].
* Do not crash PHP. Make the shortcode quantifier possessive to avoid backtracks.
* Reduce backtracking in long HTML comments by 100x.
* Do not ignore unclosed HTML comments.
* Do not break unregistered shortcodes, e.g. `[hello attr="value"]`.
* Do not break HTML in shortcode attributes, e.g. `[hello attr="<"]`.
* Do not match for shortcodes when there is extra whitespace, e.g. `[ hello ]`.
* Add unit tests to show #12690 was not fully resolved.
* Tested PHP 5.2.4, 5.2.13, 5.4.32, and 5.5.8.

Adds/modifies unit tests.

Props miqrogroove.
See #29557.


git-svn-id: https://develop.svn.wordpress.org/trunk@29781 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Scott Taylor
2014-09-29 04:06:54 +00:00
parent 18adbb6439
commit 23f7f53be2
3 changed files with 100 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/phpunit/tests/formatting/WPTexturize.php
+64 -12
View File
@@ -1187,14 +1187,30 @@ class Tests_Formatting_WPTexturize extends WP_UnitTestCase {
function data_tag_avoidance() {
return array(
array(
'[ ... ]',
'[ &#8230; ]',
),
array(
'[ is it wise to <a title="allow user content ] here? hmm"> maybe </a> ]',
'[ is it wise to <a title="allow user content ] here? hmm"> maybe </a> ]',
),
array(
'[is it wise to <a title="allow user content ] here? hmm"> maybe </a> ]', // HTML corruption is a known bug. See tickets #12690 and #29557.
'[is it wise to <a title="allow user content ] here? hmm&#8221;> maybe </a> ]',
),
array(
'[caption - is it wise to <a title="allow user content ] here? hmm"> maybe </a> ]',
'[caption - is it wise to <a title="allow user content ] here? hmm&#8221;> maybe </a> ]',
),
array(
'[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy </a> ]',
'[ photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy </a> ]',
),
array(
'[photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy </a>]',
'[photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy </a>]',
),
array(
'[gallery ...]',
'[gallery ...]',
@@ -1211,10 +1227,6 @@ class Tests_Formatting_WPTexturize extends WP_UnitTestCase {
'[/gallery ...]', // This would actually be ignored by the shortcode system. The decision to not texturize it is intentional, if not correct.
'[/gallery ...]',
),
array(
'[...]...[/...]', // These are potentially usable shortcodes.
'[&#8230;]&#8230;[/&#8230;]',
),
array(
'[[gallery]]...[[/gallery]]', // Shortcode parsing will ignore the inner ]...[ part and treat this as a single escaped shortcode.
'[[gallery]]&#8230;[[/gallery]]',
@@ -1223,10 +1235,6 @@ class Tests_Formatting_WPTexturize extends WP_UnitTestCase {
'[[[gallery]]]...[[[/gallery]]]', // Again, shortcode parsing matches, but only the [[gallery] and [/gallery]] parts.
'[[[gallery]]]&#8230;[[[/gallery]]]',
),
array(
'[gal>ery ...]',
'[gal>ery &#8230;]',
),
array(
'[gallery ...',
'[gallery &#8230;',
@@ -1300,8 +1308,40 @@ class Tests_Formatting_WPTexturize extends WP_UnitTestCase {
'<!--...-->',
),
array(
'<!-- ... -- >',
'<!-- ... -- >',
'<!-- ... -- > ...',
'<!-- ... -- > ...',
),
array(
'<!-- ...', // An unclosed comment is still a comment.
'<!-- ...',
),
array(
'a<!-->b', // Browsers seem to allow this.
'a<!-->b',
),
array(
'a<!--->b',
'a<!--->b',
),
array(
'a<!---->b',
'a<!---->b',
),
array(
'a<!----->b',
'a<!----->b',
),
array(
'a<!-- c --->b',
'a<!-- c --->b',
),
array(
'a<!-- c -- d -->b',
'a<!-- c -- d -->b',
),
array(
'a<!-- <!-- c --> -->b<!-- close -->',
'a<!-- <!-- c --> &#8211;>b<!-- close -->',
),
array(
'<!-- <br /> [gallery] ... -->',
@@ -1727,11 +1767,23 @@ class Tests_Formatting_WPTexturize extends WP_UnitTestCase {
),
array(
'[code ...]...[/code]', // code is not a registered shortcode.
'[code &#8230;]&#8230;[/code]',
'[code ...]...[/code]',
),
array(
'[hello ...]...[/hello]', // hello is not a registered shortcode.
'[hello &#8230;]&#8230;[/hello]',
'[hello ...]&#8230;[/hello]',
),
array(
'[...]...[/...]', // These are potentially usable shortcodes.
'[...]&#8230;[/...]',
),
array(
'[gal>ery ...]',
'[gal>ery ...]',
),
array(
'[randomthing param="test"]',
'[randomthing param="test"]',
),
array(
'[[audio]...[/audio]...', // These are potentially usable shortcodes. Unfortunately, the meaning of [[audio] is ambiguous unless we run the entire shortcode regexp.