From 569d37bea90bda70063141932c44dffa2088c454 Mon Sep 17 00:00:00 2001
From: Renatho De Carli Rosa <renatho@gmail.com>
Date: Mon, 11 Nov 2024 17:59:25 -0300
Subject: [PATCH] Fix content clickable when having HTML attributes with "<" in
 the value (#39931)

* Fix content clickable when having attriutes with < inside

* Add changelog

* Add test
---
 projects/plugins/wpcomsh/changelog/fix-content-clickable | 4 ++++
 projects/plugins/wpcomsh/tests/test-wpcomsh.php          | 7 +++++--
 projects/plugins/wpcomsh/wpcomsh.php                     | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)
 create mode 100644 projects/plugins/wpcomsh/changelog/fix-content-clickable

diff --git a/projects/plugins/wpcomsh/changelog/fix-content-clickable b/projects/plugins/wpcomsh/changelog/fix-content-clickable
new file mode 100644
index 0000000000000..6da2dba1ca6ba
--- /dev/null
+++ b/projects/plugins/wpcomsh/changelog/fix-content-clickable
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fixed
+
+Fix function that add links to URLs in the page when having HTML attributes with "<" in the value
diff --git a/projects/plugins/wpcomsh/tests/test-wpcomsh.php b/projects/plugins/wpcomsh/tests/test-wpcomsh.php
index 524d985812021..0357626a8f2c7 100644
--- a/projects/plugins/wpcomsh/tests/test-wpcomsh.php
+++ b/projects/plugins/wpcomsh/tests/test-wpcomsh.php
@@ -29,6 +29,7 @@ public function test_wpcomsh_make_content_clickable() {
 		$div_skip                       = '<div class="skip-make-clickable test">https://wp.com</div>';
 		$custom_element                 = '<custom-element>https://wp.com</custom-element>';
 		$custom_element_starts_with_pre = '<presto-player>https://wp.com</presto-player>';
+		$link_inside_tag_inside_attr    = "\n" . '<li data-test="<a href=\&quot;https://wp.com\&quot;&gt;Link</a&gt;"></li>';
 
 		$original_content = '' .
 		$script .
@@ -40,7 +41,8 @@ public function test_wpcomsh_make_content_clickable() {
 		$textarea .
 		$div_skip .
 		$custom_element .
-		$custom_element_starts_with_pre;
+		$custom_element_starts_with_pre .
+		$link_inside_tag_inside_attr;
 
 		$expected_output = '' .
 		'<script>https://wp.com</script>' .
@@ -52,7 +54,8 @@ public function test_wpcomsh_make_content_clickable() {
 		'<textarea>https://wp.com</textarea>' .
 		'<div class="skip-make-clickable test">https://wp.com</div>' .
 		'<custom-element><a href="https://wp.com" rel="nofollow">https://wp.com</a></custom-element>' . // Made clickable
-		'<presto-player><a href="https://wp.com" rel="nofollow">https://wp.com</a></presto-player>'; // Made clickable even if it starts with `<pre`
+		'<presto-player><a href="https://wp.com" rel="nofollow">https://wp.com</a></presto-player>' . // Made clickable even if it starts with `<pre`
+		"\n" . '<li data-test="<a href=\&quot;https://wp.com\&quot;&gt;Link</a&gt;"></li>'; // Don't make clickable if it's inside a tag inside an attribute.
 
 		$this->assertEquals( $expected_output, wpcomsh_make_content_clickable( $original_content ) );
 	}
diff --git a/projects/plugins/wpcomsh/wpcomsh.php b/projects/plugins/wpcomsh/wpcomsh.php
index 92bacc4441469..1c609132d8dc6 100644
--- a/projects/plugins/wpcomsh/wpcomsh.php
+++ b/projects/plugins/wpcomsh/wpcomsh.php
@@ -387,7 +387,7 @@ function wpcomsh_make_content_clickable( $content ) {
 	// don't look in <a></a>, <pre></pre>, <script></script> and <style></style>
 	// use <div class="skip-make-clickable"> in support docs where linkifying
 	// breaks shortcodes, etc.
-	$_split  = preg_split( '/(<[^<>]+>)/i', $content, -1, PREG_SPLIT_DELIM_CAPTURE );
+	$_split  = preg_split( '/(<[^>]+>)/i', $content, -1, PREG_SPLIT_DELIM_CAPTURE );
 	$end     = '';
 	$out     = '';
 	$combine = '';