From fb6598c9f7fc2ee6cdff9c3773d5bb462fe578ee Mon Sep 17 00:00:00 2001
From: jdarwood007 <unmonitored+github@sleepycode.com>
Date: Sat, 17 Oct 2026 13:24:51 -0700
Subject: [PATCH] [3.0] BBC didn't handlespecialchars properly

---
 Sources/BBCode/Attach.php        | 4 ++++
 Sources/BBCode/Img.php           | 3 ++-
 Sources/Parsers/BBCodeParser.php | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/Sources/BBCode/Attach.php b/Sources/BBCode/Attach.php
index 1d8da13e202..3511d432284 100644
--- a/Sources/BBCode/Attach.php
+++ b/Sources/BBCode/Attach.php
@@ -101,6 +101,10 @@ public function validate(BBCodeInterface &$bbc, array|string &$data, array $disa
 			}
 		}
 
+		foreach (['alt', 'width', 'height'] as $k) {
+			$params[$k] = Utils::htmlspecialchars($params[$k], ENT_QUOTES);
+		}
+
 		// Embedded file.
 		if ($params['{display}'] == 'embed') {
 			$alt = ' alt="' . (!empty($params['{alt}']) ? $params['{alt}'] : $current_attachment['name']) . '"';
diff --git a/Sources/BBCode/Img.php b/Sources/BBCode/Img.php
index c1d39e65c68..68396c8e011 100644
--- a/Sources/BBCode/Img.php
+++ b/Sources/BBCode/Img.php
@@ -16,6 +16,7 @@
 namespace SMF\BBCode;
 
 use SMF\Url;
+use SMF\Utils;
 
 /**
  * Represents the img BBCode.
@@ -74,7 +75,7 @@ public function validate(BBCodeInterface &$bbc, array|string &$data, array $disa
 			$url = $url->proxied();
 		}
 
-		$alt = !empty($params['{alt}']) ? ' alt="' . $params['{alt}'] . '"' : ' alt=""';
+		$alt = !empty($params['{alt}']) ? ' alt="' . Utils::htmlspecialchars($params['{alt}'], ENT_QUOTES) . '"' : ' alt=""';
 		$title = !empty($params['{title}']) ? ' title="' . $params['{title}'] . '"' : '';
 
 		$data = isset($disabled[$bbc->tag]) ? $url : '<img src="' . $url . '"' . $alt . $title . $params['{width}'] . $params['{height}'] . ' class="bbc_img' . (!empty($params['{width}']) || !empty($params['{height}']) ? ' resized' : '') . '" loading="lazy">';
diff --git a/Sources/Parsers/BBCodeParser.php b/Sources/Parsers/BBCodeParser.php
index e1330830d54..4abb103acf5 100644
--- a/Sources/Parsers/BBCodeParser.php
+++ b/Sources/Parsers/BBCodeParser.php
@@ -1964,7 +1964,7 @@ protected function detectBBCode(string $tag_character): array
 					}
 
 					// Just to make sure: replace any $ or { so they can't interpolate wrongly.
-					$params['{' . $key . '}'] = Utils::htmlspecialchars(strtr($params['{' . $key . '}'], ['$' => '&#036;', '{' => '&#123;']), ENT_QUOTES);
+					$params['{' . $key . '}'] = strtr($params['{' . $key . '}'], ['$' => '&#036;', '{' => '&#123;']);
 				}
 
 				foreach ($possible->parameters as $p => $info) {