Automattic / Automattic/jetpack
Can't use ] character in contact form attributes.
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
#### Steps to reproduce the issue
1. In the New Post screen, click "Add Contact Form".
2. Set the `subject` attribute of the `[contact-form]` shortcode tag to `"[Contact Form Submission]"`.
#### What I expected
The form would display correctly on the website.
#### What happened instead
Everything after the `]` in the `subject` attribute is output on the webpage.
For example, this contact form shortcode:
```
[contact-form subject="[Contact Form Submission]" to="admin@example.com"][contact-field label="Name" type="name" required="true" /][contact-field label="Email" type="email" required="true" /][contact-field label="Website" type="url" /][contact-field label="Message" type="textarea" /][/contact-form]
```
inadvertently leaks my email address:

Contributor guide
Research direction
Start from the contact-form shortcode entry point and reproduce the issue using the subject attribute shown in the report. Add a regression test for a subject containing a literal `]`, then verify that the complete shortcode renders without outputting the remaining attributes or exposing the email address.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, wordpress
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100