[wp-trac] [WordPress Trac] #33102: Shortcodes with Quoted Attributes Break Inside of Quoted HTML Attributes

[WordPress Trac]

#33102: Shortcodes with Quoted Attributes Break Inside of Quoted HTML Attributes
--------------------------+------------------------------
 Reporter:  cgrymala      |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Shortcodes    |     Version:  4.2.3
 Severity:  normal        |  Resolution:
 Keywords:  needs-patch   |     Focuses:
--------------------------+------------------------------

Comment (by cgrymala):

 Replying to [comment:24 georgestephanis]:

 With shortcodes already being broken when we would like things to be
 interpreted as:

 > {{{
 > <img
 >     src="#"
 >     title="
 >         [foo bar=" baz=" nope]
 >     "
 > >
 > }}}

 What if we were to add a parameter to the `add_shortcode()` function that
 allows us to specify whether the shortcode should be processed prior to
 kses or after kses? By default, the shortcode would be processed after
 kses, as is the new default anyway, but this would potentially allow us to
 specify that a shortcode should always be interpreted in the first manner
 (process the shortcode before parsing the HTML element for attributes)
 without breaking the new manner of handling things.

 Is that a reasonable possibility?

 It seems to be basically the way plugin authors are already trying to
 short-circuit this issue anyway (grabbing and processing various bits of
 code before it gets to the kses or even the `do_shortcode()` part of the
 process), and it would give us a uniform way to do it instead of having a
 lot of independent, possibly dangerous, one-off solutions to the issue.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/33102#comment:28>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform