From fcc0f498d2335a1588b1b1c0b4c50b0452e7a70b Mon Sep 17 00:00:00 2001
From: HasnainAshfaq <hasnain.sop@gmail.com>
Date: Sat, 25 Jul 2026 17:59:39 +0500
Subject: [PATCH] Formatting: Fix wptexturize encoding ampersands inside
 script/pre/code when content contains <
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a no-texturize tag (script, pre, code, etc.) contains a raw '<' character
— as in JavaScript like `if(a<b)` — wp_html_split() misidentifies the content
after that '<' as an HTML element delimiter. Previously, the texturize loop
would encode '&' characters in that false delimiter (e.g. '&&' became
'&#038;&#038;'), corrupting script content.

Fix: only run the '&' → '&#038;' substitution when we are not already inside a
no-texturize tag stack. Real HTML tag attributes (e.g. <a href="foo&bar">) are
only encountered at the top level, so the fix does not affect them.

This became more user-visible in WordPress 7.0, which introduced a dedicated
JavaScript panel in the Custom HTML block where users enter code that can
contain '<' comparisons.

Fixes #43785.
---
 src/wp-includes/formatting.php                | 14 ++++++++--
 .../phpunit/tests/formatting/wpTexturize.php  | 28 +++++++++++++++++++
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/formatting.php b/src/wp-includes/formatting.php
index 74a28109b6536..c67a5be811c25 100644
--- a/src/wp-includes/formatting.php
+++ b/src/wp-includes/formatting.php
@@ -250,8 +250,18 @@ function wptexturize( $text, $reset = false ) {
 			} else {
 				// This is an HTML element delimiter.
 
-				// Replace each & with &#038; unless it already looks like an entity.
-				$curl = preg_replace( '/&(?!#(?:\d+|x[a-f0-9]+);|[a-z1-4]{1,8};)/i', '&#038;', $curl );
+				/*
+				 * Replace each & with &#038; unless it already looks like an entity,
+				 * but only when outside no-texturize tags like <script> and <pre>.
+				 *
+				 * When a no-texturize tag contains a raw '<' character (e.g. JavaScript
+				 * like `if(a<b)`), preg_split() with _get_wptexturize_split_regex()
+				 * misidentifies that content as an HTML element delimiter. Encoding &
+				 * inside such a token would corrupt the script or preformatted content.
+				 */
+				if ( empty( $no_texturize_tags_stack ) ) {
+					$curl = preg_replace( '/&(?!#(?:\d+|x[a-f0-9]+);|[a-z1-4]{1,8};)/i', '&#038;', $curl );
+				}
 
 				_wptexturize_pushpop_element( $curl, $no_texturize_tags_stack, $no_texturize_tags );
 			}
diff --git a/tests/phpunit/tests/formatting/wpTexturize.php b/tests/phpunit/tests/formatting/wpTexturize.php
index fa81245c83bb9..14650b237400c 100644
--- a/tests/phpunit/tests/formatting/wpTexturize.php
+++ b/tests/phpunit/tests/formatting/wpTexturize.php
@@ -34,6 +34,34 @@ public function test_disable() {
 		$this->assertSame( $invalid_nest, wptexturize( $invalid_nest ) );
 	}
 
+	/**
+	 * @ticket 43785
+	 * @covers ::wptexturize
+	 */
+	public function test_no_texturize_ampersand_inside_script_with_less_than() {
+		$this->assertSame(
+			'<script>if(a<b)window&&document</script>',
+			wptexturize( '<script>if(a<b)window&&document</script>' )
+		);
+		$this->assertSame(
+			'<script type="text/javascript">if(a<b)window&&document</script>',
+			wptexturize( '<script type="text/javascript">if(a<b)window&&document</script>' )
+		);
+		$this->assertSame(
+			'<pre>if(a<b)c&&d</pre>',
+			wptexturize( '<pre>if(a<b)c&&d</pre>' )
+		);
+		$this->assertSame(
+			'<code>if(a<b)c&&d</code>',
+			wptexturize( '<code>if(a<b)c&&d</code>' )
+		);
+		// Ensure & in real HTML attributes is still encoded outside no-texturize tags.
+		$this->assertSame(
+			'<a href="foo&#038;bar">link</a>',
+			wptexturize( '<a href="foo&bar">link</a>' )
+		);
+	}
+
 	/**
 	 * @ticket 1418
 	 */