Automattic / Automattic/jetpack

Can't use ] character in contact form attributes.

Open
#7,713 10 comments 0 reactions 0 assignees View on GitHub
[Feature] Forms [Pri] Normal Bug
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

#### Steps to reproduce the issue

1. In the New Post screen, click "Add Contact Form".
2. Set the `subject` attribute of the `[contact-form]` shortcode tag to `"[Contact Form Submission]"`.

#### What I expected

The form would display correctly on the website.

#### What happened instead

Everything after the `]` in the `subject` attribute is output on the webpage.

For example, this contact form shortcode:

```
[contact-form subject="[Contact Form Submission]" to="admin@example.com"][contact-field label="Name" type="name" required="true" /][contact-field label="Email" type="email" required="true" /][contact-field label="Website" type="url" /][contact-field label="Message" type="textarea" /][/contact-form]
```

inadvertently leaks my email address:

screen shot 2017-08-29 at 12 45 14 pm

Contributor guide

Open the contributing guide

Research direction

Start from the contact-form shortcode entry point and reproduce the issue using the subject attribute shown in the report. Add a regression test for a subject containing a literal `]`, then verify that the complete shortcode renders without outputting the remaining attributes or exposing the email address.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.