From 7735a48368a0dc05d240477d9ec0fd98e5d5f845 Mon Sep 17 00:00:00 2001
From: Kamran Abdul Aziz <kamran@shifteq.com>
Date: Thu, 20 Aug 2026 17:01:52 +0530
Subject: [PATCH] General: Preserve percent signs in tooltip buttons

`wp_get_tooltip()` and `wp_get_toggletip()` concatenated caller-supplied
button markup into a `sprintf()` format string, so literal percent signs
in valid markup were read as conversion specifications.

This caused fatal errors or silently corrupted output, including
percent-encoded URLs.

Build the generated button with its final label, icon, and popover
target rather than with placeholders, then pass the button markup to
`sprintf()` as a value. Caller-supplied button markup is no longer
scanned or substituted.

See #65914.
---
 src/wp-includes/general-template.php         | 38 ++++++---
 tests/phpunit/tests/general/wpGetTooltip.php | 84 ++++++++++++++++++++
 2 files changed, 110 insertions(+), 12 deletions(-)

diff --git a/src/wp-includes/general-template.php b/src/wp-includes/general-template.php
index 22a1d3e307d3e..346c14625a3ce 100644
--- a/src/wp-includes/general-template.php
+++ b/src/wp-includes/general-template.php
@@ -473,7 +473,7 @@ function wp_get_tooltip_helper( $content, $args = array() ) {
 
 	$defaults = array(
 		'id'          => wp_unique_id( 'wp-tooltip-' ),
-		'button'      => '<button type="button" aria-label="%3$s"><span class="dashicons %4$s" aria-hidden="true"></span></button>',
+		'button'      => '',
 		'label'       => __( 'Help' ),
 		'close_label' => __( 'Close' ),
 		'icon'        => 'dashicons-editor-help',
@@ -488,15 +488,29 @@ function wp_get_tooltip_helper( $content, $args = array() ) {
 		$classes .= ' ' . $args['class'];
 	}
 
-	$icon      = ( $args['icon'] ) ? trim( $args['icon'] ) : $defaults['icon'];
-	$id        = ( $args['id'] ) ? $args['id'] : $defaults['id'];
-	$button    = ( $args['button'] ) ? $args['button'] : $defaults['button'];
+	$icon = ( $args['icon'] ) ? trim( $args['icon'] ) : $defaults['icon'];
+	$id   = ( $args['id'] ) ? $args['id'] : $defaults['id'];
+
+	// Tooltips use the content as the accessible name; toggletips use the label.
+	$label = ( 'tooltip' === $args['type'] ) ? wp_strip_all_tags( $content, true ) : $args['label'];
+
+	/*
+	 * The generated button is built with its final values rather than with
+	 * placeholders, so that caller-supplied markup is never scanned or
+	 * substituted. A percent sign in custom markup, such as a percent-encoded
+	 * URL, is therefore never treated as a conversion specification.
+	 */
+	$default_button = '<button type="button" aria-label="' . esc_attr( $label ) . '">' .
+		'<span class="dashicons ' . esc_attr( $icon ) . '" aria-hidden="true"></span>' .
+	'</button>';
+
+	$button    = ( $args['button'] ) ? $args['button'] : $default_button;
 	$processed = false;
 	$processor = new WP_HTML_Tag_Processor( $button );
 	if ( true === $processor->next_tag( 'button' ) ) {
 		$processor->add_class( 'wp-tooltip__toggle' );
 		if ( 'tooltip' !== $args['type'] ) {
-			$processor->set_attribute( 'popovertarget', '%2$s' );
+			$processor->set_attribute( 'popovertarget', $id );
 			$processor->set_attribute( 'aria-haspopup', 'dialog' );
 		}
 		$button    = $processor->get_updated_html();
@@ -512,10 +526,10 @@ function wp_get_tooltip_helper( $content, $args = array() ) {
 	}
 	if ( ! $processed ) {
 		// Button HTML passed was not valid.
-		$processor = new WP_HTML_Tag_Processor( $defaults['button'] );
+		$processor = new WP_HTML_Tag_Processor( $default_button );
 		$processor->add_class( 'wp-tooltip__toggle' );
 		if ( 'tooltip' !== $args['type'] ) {
-			$processor->set_attribute( 'popovertarget', '%2$s' );
+			$processor->set_attribute( 'popovertarget', $id );
 			$processor->set_attribute( 'aria-haspopup', 'dialog' );
 		}
 		$button = $processor->get_updated_html();
@@ -528,11 +542,9 @@ function wp_get_tooltip_helper( $content, $args = array() ) {
 	 * the layout. See #65660.
 	 */
 	if ( 'tooltip' === $args['type'] ) {
-		// Tooltips are only used to visually display labels.
-		$label  = wp_strip_all_tags( $content, true );
 		$markup = sprintf(
 			'<span class="%1$s">
-				' . $button . '
+				%6$s
 				<span popover="hint" id="%2$s" class="wp-tooltip__bubble" role="tooltip">' .
 					'<span id="%2$s-text" class="wp-tooltip__text">%5$s</span>' .
 				'</span>' .
@@ -542,6 +554,7 @@ function wp_get_tooltip_helper( $content, $args = array() ) {
 			esc_attr( $label ),
 			esc_attr( $icon ),
 			esc_html( $content ),
+			$button,
 		);
 	} else {
 		/*
@@ -551,7 +564,7 @@ function wp_get_tooltip_helper( $content, $args = array() ) {
 		 */
 		$markup = sprintf(
 			'<span class="%1$s">
-				' . $button . '
+				%7$s
 				<span popover="auto" id="%2$s" class="wp-tooltip__bubble" role="dialog" aria-label="%3$s" tabindex="-1" autofocus>' .
 					'<span id="%2$s-text" class="wp-tooltip__text">%5$s</span>' .
 					'<button type="button" class="wp-tooltip__close" popovertarget="%2$s" popovertargetaction="hide" aria-label="%6$s">' .
@@ -561,10 +574,11 @@ function wp_get_tooltip_helper( $content, $args = array() ) {
 			'</span>',
 			esc_attr( $classes ),
 			esc_attr( $id ),
-			esc_attr( $args['label'] ),
+			esc_attr( $label ),
 			esc_attr( $icon ),
 			esc_html( $content ),
 			esc_attr( $args['close_label'] ),
+			$button,
 		);
 	}
 
diff --git a/tests/phpunit/tests/general/wpGetTooltip.php b/tests/phpunit/tests/general/wpGetTooltip.php
index e545902e6ed6d..3687f878d238e 100644
--- a/tests/phpunit/tests/general/wpGetTooltip.php
+++ b/tests/phpunit/tests/general/wpGetTooltip.php
@@ -206,6 +206,90 @@ public function test_wp_get_toggletip_bubble_uses_dialog_role_and_autofocus() {
 		$this->assertStringContainsString( 'tabindex="-1" autofocus>', $html );
 	}
 
+	/**
+	 * Tests that a percent sign in the button markup is not treated as a
+	 * `sprintf()` conversion specification.
+	 *
+	 * @ticket 65914
+	 *
+	 * @dataProvider data_button_markup_containing_percent_signs
+	 *
+	 * @param string $button   Button markup containing a percent sign.
+	 * @param string $expected Substring that must be preserved in the output.
+	 */
+	public function test_wp_get_tooltip_preserves_percent_signs_in_button_markup( $button, $expected ) {
+		$this->assertStringContainsString(
+			$expected,
+			wp_get_tooltip( 'Helpful text.', array( 'button' => $button ) ),
+			'The tooltip did not preserve the percent sign.'
+		);
+		$this->assertStringContainsString(
+			$expected,
+			wp_get_toggletip( 'Helpful text.', array( 'button' => $button ) ),
+			'The toggletip did not preserve the percent sign.'
+		);
+	}
+
+	/**
+	 * Tests that a percent-encoded URL in anchor markup is not rewritten.
+	 *
+	 * @ticket 65914
+	 *
+	 * @dataProvider data_percent_encoded_hrefs
+	 *
+	 * @param string $href A percent-encoded URL.
+	 */
+	public function test_wp_get_tooltip_preserves_percent_encoding_in_anchor_href( $href ) {
+		$html = wp_get_tooltip(
+			'Helpful text.',
+			array( 'button' => '<a href="' . $href . '">Search</a>' )
+		);
+
+		$this->assertStringContainsString( 'href="' . $href . '"', $html );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public function data_percent_encoded_hrefs() {
+		return array(
+			'an encoded space' => array( '/wp-admin/edit.php?s=hello%20world' ),
+			'an encoded slash' => array( '/x?p=a%2Fb' ),
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public function data_button_markup_containing_percent_signs() {
+		return array(
+			'a literal percent sign'      => array(
+				'<button type="button">100% done</button>',
+				'100% done',
+			),
+			'a percent sign then a word'  => array(
+				'<button type="button">Save 20%!</button>',
+				'Save 20%!',
+			),
+			'an unknown format specifier' => array(
+				'<button type="button">Buy %q now</button>',
+				'Buy %q now',
+			),
+			'a percent sign in an ID'     => array(
+				'<button type="button" aria-describedby="box_100%_complete-title">Move up</button>',
+				'aria-describedby="box_100%_complete-title"',
+			),
+			'text resembling a argnum'    => array(
+				'<button type="button">Use %2$s in your code</button>',
+				'Use %2$s in your code',
+			),
+		);
+	}
+
 	/**
 	 * Data provider.
 	 *