Fix content clickable when having HTML attributes with "<" in the val…

…ue (#39931) * Fix content clickable when having attriutes with < inside * Add changelog * Add test
Automattic · Nov 11, 2024 · 569d37b · 569d37b
1 parent 7e694b3
commit 569d37b
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/projects/plugins/wpcomsh/changelog/fix-content-clickable b/projects/plugins/wpcomsh/changelog/fix-content-clickable
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fixed
+
+Fix function that add links to URLs in the page when having HTML attributes with "<" in the value
diff --git a/projects/plugins/wpcomsh/tests/test-wpcomsh.php b/projects/plugins/wpcomsh/tests/test-wpcomsh.php
@@ -29,6 +29,7 @@ public function test_wpcomsh_make_content_clickable() {
 		$div_skip                       = '<div class="skip-make-clickable test">https://wp.com</div>';
 		$custom_element                 = '<custom-element>https://wp.com</custom-element>';
 		$custom_element_starts_with_pre = '<presto-player>https://wp.com</presto-player>';
+		$link_inside_tag_inside_attr    = "\n" . '<li data-test="<a href=\&quot;https://wp.com\&quot;&gt;Link</a&gt;"></li>';
 
 		$original_content = '' .
 		$script .
@@ -40,7 +41,8 @@ public function test_wpcomsh_make_content_clickable() {
 		$textarea .
 		$div_skip .
 		$custom_element .
-		$custom_element_starts_with_pre;
+		$custom_element_starts_with_pre .
+		$link_inside_tag_inside_attr;
 
 		$expected_output = '' .
 		'<script>https://wp.com</script>' .
@@ -52,7 +54,8 @@ public function test_wpcomsh_make_content_clickable() {
 		'<textarea>https://wp.com</textarea>' .
 		'<div class="skip-make-clickable test">https://wp.com</div>' .
 		'<custom-element><a href="https://wp.com" rel="nofollow">https://wp.com</a></custom-element>' . // Made clickable
-		'<presto-player><a href="https://wp.com" rel="nofollow">https://wp.com</a></presto-player>'; // Made clickable even if it starts with `<pre`
+		'<presto-player><a href="https://wp.com" rel="nofollow">https://wp.com</a></presto-player>' . // Made clickable even if it starts with `<pre`
+		"\n" . '<li data-test="<a href=\&quot;https://wp.com\&quot;&gt;Link</a&gt;"></li>'; // Don't make clickable if it's inside a tag inside an attribute.
 
 		$this->assertEquals( $expected_output, wpcomsh_make_content_clickable( $original_content ) );
 	}

diff --git a/projects/plugins/wpcomsh/wpcomsh.php b/projects/plugins/wpcomsh/wpcomsh.php
@@ -387,7 +387,7 @@ function wpcomsh_make_content_clickable( $content ) {
 	// don't look in <a></a>, <pre></pre>, <script></script> and <style></style>
 	// use <div class="skip-make-clickable"> in support docs where linkifying
 	// breaks shortcodes, etc.
-	$_split  = preg_split( '/(<[^<>]+>)/i', $content, -1, PREG_SPLIT_DELIM_CAPTURE );
+	$_split  = preg_split( '/(<[^>]+>)/i', $content, -1, PREG_SPLIT_DELIM_CAPTURE );
 	$end     = '';
 	$out     = '';
 	$combine = '';