Skip to content

HTML API: Fix decoded attribute prefix matching #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sirreal wants to merge 1 commit into
base: trunk
Choose a base branch
from
Open

HTML API: Fix decoded attribute prefix matching #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions src/wp-includes/html-api/class-wp-html-decoder.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,17 +60,23 @@ public static function attribute_starts_with( $haystack, $search_text, $case_sen
continue;
}

// If there is a character reference, then the decoded value must exactly match what follows in the search string.
if ( 0 !== substr_compare( $search_text, $next_chunk, $search_at, strlen( $next_chunk ), $loose_case ) ) {
/*
* If there is a character reference, then the decoded value must
* match what follows in the search string. The search string may
* end within a multi-code-point replacement, such as `<⃒`
* decoding to `<⃒`, and still be a prefix match.
*/
$match_length = min( strlen( $next_chunk ), $search_length - $search_at );
if ( 0 !== substr_compare( $search_text, $next_chunk, $search_at, $match_length, $loose_case ) ) {
return false;
}

// The character reference matched, so continue checking.
$haystack_at += $token_length;
$search_at += strlen( $next_chunk );
$search_at += $match_length;
}

return true;
return $search_at === $search_length;
}

/**
Expand Down
5 changes: 5 additions & 0 deletions tests/phpunit/tests/html-api/wpHtmlDecoder.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,11 @@ public static function data_attributes_with_prefix_and_case_sensitive_match() {
array( 'http://wordpress.org', 'Http', 'ascii-case-insensitive', true ),
array( 'http://wordpress.org', 'https', 'case-sensitive', false ),
array( 'http://wordpress.org', 'https', 'ascii-case-insensitive', false ),
array( '', 'http', 'case-sensitive', false ),
array( 'jav', 'javascript:', 'case-sensitive', false ),
array( 'jav', 'javascript:', 'ascii-case-insensitive', false ),
array( '&nvlt;script', '<', 'case-sensitive', true ),
array( '&nvgt;script', '>', 'case-sensitive', true ),
);
}
}
Loading