Escaped Shortcodes don't work in Block themes

[TobiasBg]

The WordPress Shortcode API supports escaping of Shortcodes, by wrapping them in extra square brackets, like [[shortcodetag]], so that the Shortcode is printed as text instead of being evaluated.

This is not working in Block themes, it appears.

To reproduce this:

• Set up a normal WordPress site, e.g. using trunk.
• Choose a block theme, like Twenty Twenty-Three.
• Add a simple test plugin that adds a Shortcode, like

  <?php
  /*
  Plugin Name: Shortcode Test
  Description: Shortcode Test
  Version: 1.0
  */
  
  add_shortcode( 'test', 'shortcode_test' );
  function shortcode_test( $atts, $content ) {
      return 'Just a test';
  }
  

• Add a new post or page, with this test content:

  This is an escaped Shortcode: [[test]] .
  
  Here, it's evaluated: [test] .
  

• Note how after saving, when viewing the page, the escaped Shortcode is also evaluated.
• Repeat this with classic theme, like Twenty Twenty-One.
• Note how the escaped Shortcode is properly shown as text.

[costdev]

Reproduction Report

This report validates that the issue can be reproduced.

Environment

• Server: Apache (Linux)
• WordPress: 6.2-beta1-55292-src
• Browser: Chrome 109.0.0.0
• OS: Windows 10
• Themes:
  • Twenty Ten through Twenty-Twenty Three
• Plugins:
  • Shortcode Test 1.0

Expected Results

• 🐞 Twenty-Twenty Two/Three: The shortcode is evaluated when viewing the single post on the frontend.
• ✅ Twenty Ten through Twenty-Twenty One: The shortcode is not evaluated when viewing the single post on the frontend.
• ✅ Twenty Ten through Twenty-Twenty One: The shortcode is not evaluated when viewing the home page when set to show latest posts.

Actual Results

• 🐞 Twenty-Twenty Two/Three: The shortcode is evaluated when viewing the single post on the frontend.
• ✅ Twenty Ten through Twenty-Twenty One: The shortcode is not evaluated when viewing the single post on the frontend.
• ✅ Twenty Ten through Twenty-Twenty: The shortcode is not evaluated when viewing the home page when set to show latest posts.
• 🐞 Twenty-Twenty One: The shortcode is evaluated when viewing the home page when set to show latest posts.

Notes

• It appears that this issue occurs on Twenty-Twenty Two and Twenty-Twenty Three on the home page and on a single post, but also on Twenty-Twenty One on the home page.

[costdev]

Ah, it looks like the issue with Twenty-Twenty One shown during testing is because it uses the_excerpt() on the home page, which doesn't appear to escape shortcodes. Ignore that part of the reproduction report above, but the lack of escaping in block themes was verified 👍

[costdev]

Looking into this more, it appears that when using a block theme, do_shortcode() is hooked to the_content twice. The first run renders a literal [test], and the second run evaluates it.

Adding this to the top of do_shortcode() shows that when limited to only one run on the_content, the shortcode is correctly escaped:

<?php
if ( doing_filter( 'the_content' ) && wp_get_theme()->is_block_theme() ) {
        static $did_block_theme_the_content = false;

        if ( $did_block_theme_the_content ) {
                return $content;
        }

        $did_block_theme_the_content = true;
}

[ocean90]

Sounds like a duplicate of #55996.

[costdev]

@ocean90 Nice catch! ​PR 3549 from #55996 seems to resolve the issue.

Closing this ticket as a duplicate of #55996. Let's continue the discussion there.