From 2504efcf9439c1961c4108057e8f3f48239a244b Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Tue, 12 Mar 2019 22:15:50 +0000
Subject: [PATCH] Formatting: Improve `rel="nofollow"` handling in comments.
 Built from https://develop.svn.wordpress.org/trunk@44833

git-svn-id: http://core.svn.wordpress.org/trunk@44665 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/formatting.php | 14 ++++++++------
 wp-includes/version.php    |  2 +-
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php
index 41747ebdef..c29c025136 100644
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -3004,10 +3004,12 @@ function wp_rel_nofollow_callback( $matches ) {
 	$atts = shortcode_parse_atts( $matches[1] );
 	$rel  = 'nofollow';
 
-	if ( preg_match( '%href=["\'](' . preg_quote( set_url_scheme( home_url(), 'http' ) ) . ')%i', $text ) ||
-		preg_match( '%href=["\'](' . preg_quote( set_url_scheme( home_url(), 'https' ) ) . ')%i', $text ) ) {
-
-		return "<a $text>";
+	if ( ! empty( $atts['href'] ) ) {
+		if ( in_array( strtolower( wp_parse_url( $atts['href'], PHP_URL_SCHEME ) ), array( 'http', 'https' ), true ) ) {
+			if ( strtolower( wp_parse_url( $atts['href'], PHP_URL_HOST ) ) === strtolower( wp_parse_url( home_url(), PHP_URL_HOST ) ) ) {
+				return "<a $text>";
+			}
+		}
 	}
 
 	if ( ! empty( $atts['rel'] ) ) {
@@ -3020,11 +3022,11 @@ function wp_rel_nofollow_callback( $matches ) {
 
 		$html = '';
 		foreach ( $atts as $name => $value ) {
-			$html .= "{$name}=\"$value\" ";
+			$html .= "{$name}=\"" . esc_attr( $value ) . "\" ";
 		}
 		$text = trim( $html );
 	}
-	return "<a $text rel=\"$rel\">";
+	return "<a $text rel=\"" . esc_attr( $rel ) . "\">";
 }
 
 /**
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 4415f151e1..b004ec0b24 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.2-alpha-44832';
+$wp_version = '5.2-alpha-44833';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.