Automattic / Automattic/blocks-everywhere
bbPress: HTML within code tags unescaped
- Dominant language
- PHP
- Stars
- 94
- Forks
- 21
- PR merge metrics
- No merged PRs in 30d
Description
As per https://meta.trac.wordpress.org/ticket/6634 HTML within `` is improperly unescaped and ultimately stripped.
This is because bbPress **expects** that code will always be within back ticks ``. It doesn't support code within `..`.
This might be a case where we can upstream something to bbPress sooner than later however.
I had originally suggested I didn't like the removal of `bbp_encode_bad()` in preference for simply adding the allowable tags, however, I wasn't aware of the shortcomings of the bbPress filtering within.
The hoops required to avoid the problematic code would likely be worse than just replacing it.. so I guess my stance has changed and I would support the wholesale removal of `bbp_encode_bad()` in preference for a replacement if it was tested appropriately.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the reported case with HTML inside ... and trace the bbPress filtering behavior around bbp_encode_bad(). Compare the current handling with the linked ticket and determine a tested replacement or upstreamable fix; done means HTML in code tags is preserved rather than unescaped and stripped.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- content
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100