Automattic / Automattic/jetpack
Shortcode Embeds: Amazon Ads <Script> replaced with <a href> In Extra Theme
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
When using the Extra-Ads widget from the [Extra theme from Elegant Themes](https://www.elegantthemes.com/gallery/extra/) a conflict is present replacing `` with `<a href=` I was not able to replicate this with the Text widget in Text Mode.
#### Steps to reproduce the issue
1.Install and activate Extra
2. Install and activate Jetpack
3. Insert the `Ads - Extra` widget into the site.
4. Add the Amazon Ad code
```
<div class="alignleft">
<script type="text/javascript">
amzn_assoc_ad_type = "banner";
amzn_assoc_marketplace = "amazon";
amzn_assoc_region = "US";
amzn_assoc_placement = "assoc_banner_placement_default";
amzn_assoc_campaigns = "amazonhomepage_2017";
amzn_assoc_banner_type = "rotating";
amzn_assoc_p = "9";
amzn_assoc_width = "180";
amzn_assoc_height = "150";
amzn_assoc_tracking_id = "ewsrocessi-20";
amzn_assoc_linkid = "####";
```
Upon save watch the second `` tag be replaced with:
``` <a href="//z-na.amazon-adsystem.com/widgets/q?ServiceVersion=20070822&Operation=GetScript&ID=OneJS&WS=1">//z-na.amazon-adsystem.com/widgets/q?ServiceVersion=20070822&Operation=GetScript&ID=OneJS&WS=1</a>```
If you repeat steps 3-4 above with Enhanced Distribution turned off the second script tag remains.
#### What I expected
For the `<script>` tag to remain untouched upon saving the widget.
#### What happened instead
Final `<script>` tag gets replaced with `href="`
#### Screenshot

<!--
PLEASE NOTE
- These comments won't show up when you submit the issue.
- Everything is optional, but try to add as many details as possible.
- If requesting a new feature, explain why you'd like to see it added.
- This issue tracker is not for support. If you have questions about Jetpack, you can [start a new thread in the Jetpack support forums](https://wordpress.org/support/plugin/jetpack#new-post), or [send us an email](http://jetpack.com/contact-support/).
- Do not report potential security vulnerabilities here. For responsible disclosure of security issues and to be eligible for our bug bounty program, please submit your report via [the HackerOne portal](https://hackerone.com/automattic).
-->
Contributor guide
Research direction
Start by reproducing the issue with the Extra-Ads widget, Jetpack, and Enhanced Distribution enabled, using the Amazon ad code from the report. Compare the saved widget output with Enhanced Distribution disabled; done means the second script tag remains a script tag and its attributes are not converted into a link.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100