Hashtag: Ignore tags within HTML attributes (like hex colors) (#1037)

Fixes #955.

Author: obenland

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+* Prevent hex color codes in HTML attributes from being added as post tags.
+
 ## [4.3.0] - 2024-12-02
 
 ### Added

includes/class-hashtag.php

@@ -55,17 +55,14 @@ public static function filter_activity_object( $activity ) {
 	public static function insert_post( $post_id, $post ) {
 		$tags = array();
 
-		if ( \preg_match_all( '/' . ACTIVITYPUB_HASHTAGS_REGEXP . '/i', $post->post_content, $match ) ) {
-			$tags = array_merge( $tags, $match[1] );
-		}
+		// Skip hashtags in HTML attributes, like hex colors.
+		$content = wp_strip_all_tags( $post->post_content . "\n" . $post->post_excerpt );
 
-		if ( \preg_match_all( '/' . ACTIVITYPUB_HASHTAGS_REGEXP . '/i', $post->post_excerpt, $match ) ) {
-			$tags = array_merge( $tags, $match[1] );
+		if ( \preg_match_all( '/' . ACTIVITYPUB_HASHTAGS_REGEXP . '/i', $content, $match ) ) {
+			$tags = array_unique( $match[1] );
 		}
 
-		$tags = \implode( ', ', $tags );
-
-		\wp_add_post_tags( $post->ID, $tags );
+		\wp_add_post_tags( $post->ID, \implode( ', ', $tags ) );
 	}
 
 	/**

readme.txt

@@ -132,6 +132,10 @@ For reasons of data protection, it is not possible to see the followers of other
 
 == Changelog ==
 
+= Unreleased =
+
+* Fixed: Prevent hex color codes in HTML attributes from being added as post tags.
+
 = 4.3.0 =
 
 * Added: A `pre_activitypub_get_upload_baseurl` filter

tests/class-test-activitypub-hashtag.php

@@ -73,4 +73,84 @@ public function the_content_provider() {
 			array( $pre, $pre ),
 		);
 	}
+
+	/**
+	 * Tests auto-converting hashtags to tags.
+	 *
+	 * @see https://github.com/Automattic/wordpress-activitypub/issues/955
+	 * @dataProvider hashtag_provider
+	 * @covers ::insert_post
+	 *
+	 * @param string   $content       The post content.
+	 * @param string   $excerpt       The post excerpt.
+	 * @param string[] $expected_tags The expected tags.
+	 * @param string   $message       The error message.
+	 */
+	public function test_hashtag_conversion( $content, $excerpt, $expected_tags, $message ) {
+		$post_id = $this->factory->post->create(
+			array(
+				'post_content' => $content,
+				'post_excerpt' => $excerpt,
+			)
+		);
+
+		\Activitypub\Hashtag::insert_post( $post_id, get_post( $post_id ) );
+		$tags = wp_get_post_tags( $post_id, array( 'fields' => 'names' ) );
+
+		foreach ( $expected_tags as $tag ) {
+			$this->assertContains( $tag, $tags, $message );
+		}
+	}
+
+	/**
+	 * Data provider for hashtag tests.
+	 *
+	 * @return array[] The data.
+	 */
+	public function hashtag_provider() {
+		return array(
+			'basic_hashtags'         => array(
+				'Testing #php and #programming',
+				'',
+				array( 'php', 'programming' ),
+				'Basic hashtags should be converted',
+			),
+			'hashtags_in_attributes' => array(
+				'<div style="color: #fff">#validtag</div>',
+				'',
+				array( 'validtag' ),
+				'Hashtags in HTML attributes should be ignored',
+			),
+			'mixed_content'          => array(
+				'Color is #red <span style="color: #ff0000">#valid</span> #blue',
+				'',
+				array( 'red', 'blue', 'valid' ),
+				'Should handle mixed content correctly',
+			),
+			'hex_in_text'            => array(
+				'<span style="color: #ff0000">#f00</span> #fff #000000',
+				'',
+				array( 'f00', 'fff', '000000' ),
+				'Hex colors in text should be converted',
+			),
+			'excerpt_tags'           => array(
+				'',
+				'Testing #excerpt with #tags',
+				array( 'excerpt', 'tags' ),
+				'Should process excerpt hashtags',
+			),
+			'multiple_attributes'    => array(
+				'<div data-color="#123" style="border: 1px solid #456">#valid</div>',
+				'',
+				array( 'valid' ),
+				'Should ignore multiple attribute hashtags',
+			),
+			'quotes_in_content'      => array(
+				'Here is a "#quoted" #tag',
+				'',
+				array( 'tag' ),
+				'Should handle quotes in content correctly',
+			),
+		);
+	}
 }