From b581c4fc1c979636b85be0026b5ec2d152fd0b54 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@xwp.co>
Date: Thu, 25 Jan 2018 16:38:52 -0800
Subject: [PATCH] Prevent saveHTML from munging amp-mustache curly braces via
 URL-encoding

---
 includes/utils/class-amp-dom-utils.php     | 56 ++++++++++++++++++++++
 tests/test-tag-and-attribute-sanitizer.php |  2 +-
 2 files changed, 57 insertions(+), 1 deletion(-)

diff --git a/includes/utils/class-amp-dom-utils.php b/includes/utils/class-amp-dom-utils.php
index cea51615da8..6d640d8e459 100644
--- a/includes/utils/class-amp-dom-utils.php
+++ b/includes/utils/class-amp-dom-utils.php
@@ -59,6 +59,22 @@ public static function get_dom( $document ) {
 		// @todo In the future consider an AMP_DOMDocument subclass that does this automatically. See <https://github.com/Automattic/amp-wp/pull/895/files#r163825513>.
 		$document = self::convert_amp_bind_attributes( $document );
 
+		/*
+		 * Prevent amp-mustache syntax from getting URL-encoded in attributes when saveHTML is done.
+		 * While this is applying to the entire document, it only really matters inside of <template>
+		 * elements, since URL-encoding of curly braces in href attributes would not normally matter.
+		 * But when this is done inside of a <template> then it breaks Mustache. Since Mustache
+		 * is logic-less and curly braces are not unsafe for HTML, we can do a global replacement.
+		 * The replacement is done on the entire HTML document instead of just inside of the <template>
+		 * elements since it is faster and wouldn't change the outcome.
+		 */
+		$placeholders = self::get_mustache_tag_placeholders();
+		$document     = str_replace(
+			array_keys( $placeholders ),
+			array_values( $placeholders ),
+			$document
+		);
+
 		/*
 		 * Wrap in dummy tags, since XML needs one parent node.
 		 * It also makes it easier to loop through nodes.
@@ -98,6 +114,38 @@ public static function get_amp_bind_placeholder_prefix() {
 		return $attribute_prefix;
 	}
 
+	/**
+	 * Get amp-mustache tag/placeholder mappings.
+	 *
+	 * @since 0.7
+	 * @see \wpdb::placeholder_escape()
+	 *
+	 * @return array Mapping of mustache tag token to its placeholder.
+	 */
+	private static function get_mustache_tag_placeholders() {
+		static $placeholders;
+		if ( ! isset( $placeholders ) ) {
+			$salt = wp_rand();
+
+			// Note: The order of these tokens is important, as it determines the order of the order of the replacements.
+			$tokens       = array(
+				'{{{',
+				'}}}',
+				'{{#',
+				'{{^',
+				'{{/',
+				'{{/',
+				'{{',
+				'}}',
+			);
+			$placeholders = array();
+			foreach ( $tokens as $token ) {
+				$placeholders[ $token ] = '_amp_mustache_' . md5( $salt . $token );
+			}
+		}
+		return $placeholders;
+	}
+
 	/**
 	 * Replace AMP binding attributes with something that libxml can parse (as HTML5 data-* attributes).
 	 *
@@ -285,6 +333,14 @@ public static function get_content_from_dom_node( $dom, $node ) {
 
 		$html = self::restore_amp_bind_attributes( $html );
 
+		// Restore amp-mustache placeholders which were replaced to prevent URL-encoded corruption by saveHTML.
+		$placeholders = self::get_mustache_tag_placeholders();
+		$html         = str_replace(
+			array_values( $placeholders ),
+			array_keys( $placeholders ),
+			$html
+		);
+
 		/*
 		 * Travis w/PHP 7.1 generates <br></br> and <hr></hr> vs. <br/> and <hr/>, respectively.
 		 * Travis w/PHP 7.x generates <source ...></source> vs. <source ... />.  Etc.
diff --git a/tests/test-tag-and-attribute-sanitizer.php b/tests/test-tag-and-attribute-sanitizer.php
index f8923d5d841..dd86c039e19 100644
--- a/tests/test-tag-and-attribute-sanitizer.php
+++ b/tests/test-tag-and-attribute-sanitizer.php
@@ -317,7 +317,7 @@ public function get_data() {
 			),
 
 			'attribute_value_valid'                                     => array(
-				'<template type="amp-mustache">Template Data</template>',
+				'<template type="amp-mustache">Hello {{world}}! <a href="{{user_url}}" title="{{user_name}}">Homepage</a> User content: {{{some_formatting}}} A guy with Mustache: :-{). {{#returning}}Welcome back!{{/returning}} {{^returning}}Welcome for the first time!{{/returning}} </template>',
 				null,
 				array( 'amp-mustache' ),
 			),