HTML API: Truncated funky comments should cause the Tag Processor to …

…pause.

A state change was missing in the Tag Processor when the input is too short to
find a comment closer after an opened funky comment. This patch fixes a issue
where `</#` does not correctly report incomplete input, but `</# ` does.

Developed in WordPress#7146
Discussed in https://core.trac.wordpress.org/ticket/61831

Props: jonsurrell.
Fixes #61831.


git-svn-id: https://develop.svn.wordpress.org/trunk@58858 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -1909,6 +1909,8 @@ private function parse_next_tag(): bool {
 			if ( $this->is_closing_tag ) {
 				// No chance of finding a closer.
 				if ( $at + 3 > $doc_length ) {
+					$this->parser_state = self::STATE_INCOMPLETE_INPUT;
+
 					return false;
 				}
 

tests/phpunit/tests/html-api/wpHtmlTagProcessor.php

@@ -2903,4 +2903,15 @@ public function test_script_tag_processing_no_infinite_loop_final_left_angle_bra
 		$this->assertFalse( $processor->next_tag() );
 		$this->assertTrue( $processor->paused_at_incomplete_token() );
 	}
+
+	/**
+	 * Test a bugfix where the input ends abruptly with a funky comment started.
+	 *
+	 * @ticket 61831
+	 */
+	public function test_unclosed_funky_comment_input_too_short() {
+		$processor = new WP_HTML_Tag_Processor( '</#' );
+		$this->assertFalse( $processor->next_tag() );
+		$this->assertTrue( $processor->paused_at_incomplete_token() );
+	}
 }