BUG Update image shortcode to not deuble escape entities

creative-commoners · Jun 19, 2024 · 9d529c7 · 9d529c7
1 parent cfb7a45
commit 9d529c7
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/src/Shortcodes/ImageShortcodeProvider.php b/src/Shortcodes/ImageShortcodeProvider.php
@@ -131,7 +131,7 @@ public static function handle_shortcode($args, $content, $parser, $shortcode, $e
         $whitelist = static::config()->get('attribute_whitelist');
         foreach ($attrs as $key => $value) {
             if (in_array($key, $whitelist) && (strlen(trim($value ?? '')) || in_array($key, ['alt', 'width', 'height']))) {
-                $manipulatedRecord = $manipulatedRecord->setAttribute($key, $value);
+                $manipulatedRecord = $manipulatedRecord->setAttribute($key, html_entity_decode($value));
             }
         }
 

diff --git a/tests/php/Shortcodes/ImageShortcodeProviderTest.php b/tests/php/Shortcodes/ImageShortcodeProviderTest.php
@@ -75,6 +75,21 @@ public function testShortcodeHandlerUsesShortcodeProperties()
         );
     }
 
+    public function testShortcodeHandlerHandlesEntities()
+    {
+        $image = $this->objFromFixture(Image::class, 'imageWithTitle');
+        // Because we are using a DOMDocument to read the values, we need to compare to non-escaped value
+        $this->assertImageTag(
+            [
+                'src' => $image->Link(),
+                'alt' => 'Alt & content',
+                'title' => '" Hockey > Rugby "',
+            ],
+            sprintf('[image id="%d" alt="Alt & content" title="&quot; Hockey &gt; Rugby &quot;"]', $image->ID),
+            'Shortcode handler can handle HTML entities'
+        );
+    }
+
     public function testShorcodeRegenrator()
     {
         $image = $this->objFromFixture(Image::class, 'imageWithTitle');