From 2a9b332a69b8ef58cba3ce6e0d44f1544e07404c Mon Sep 17 00:00:00 2001
From: Anukasha Singh <anukasha@xecurify.com>
Date: Thu, 9 Apr 2026 14:05:59 +0530
Subject: [PATCH] fixing no extension urls

---
 src/wp-includes/media.php     | 32 ++++++++++++++++++----------
 tests/phpunit/tests/media.php | 39 +++++++++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+), 11 deletions(-)

diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php
index 8f6ec1cef4e26..8ed4dfd11e1ab 100644
--- a/src/wp-includes/media.php
+++ b/src/wp-includes/media.php
@@ -3468,9 +3468,10 @@ function wp_audio_shortcode( $attr, $content = '' ) {
 
 	$primary = false;
 	if ( ! empty( $atts['src'] ) ) {
-		$type = wp_check_filetype( $atts['src'], wp_get_mime_types() );
+		$type          = wp_check_filetype( $atts['src'], wp_get_mime_types() );
+		$has_extension = (bool) pathinfo( wp_parse_url( $atts['src'], PHP_URL_PATH ), PATHINFO_EXTENSION );
 
-		if ( ! in_array( strtolower( $type['ext'] ), $default_types, true ) ) {
+		if ( $has_extension && ! in_array( strtolower( $type['ext'] ), $default_types, true ) ) {
 			return sprintf( '<a class="wp-embedded-audio" href="%s">%s</a>', esc_url( $atts['src'] ), esc_html( $atts['src'] ) );
 		}
 
@@ -3567,7 +3568,6 @@ function wp_audio_shortcode( $attr, $content = '' ) {
 
 	$html    = sprintf( '<audio %s controls="controls">', implode( ' ', $attr_strings ) );
 	$fileurl = '';
-	$source  = '<source type="%s" src="%s" />';
 
 	foreach ( $default_types as $fallback ) {
 		if ( ! empty( $atts[ $fallback ] ) ) {
@@ -3575,9 +3575,14 @@ function wp_audio_shortcode( $attr, $content = '' ) {
 				$fileurl = $atts[ $fallback ];
 			}
 
-			$type  = wp_check_filetype( $atts[ $fallback ], wp_get_mime_types() );
-			$url   = add_query_arg( '_', $instance, $atts[ $fallback ] );
-			$html .= sprintf( $source, $type['type'], esc_url( $url ) );
+			$type = wp_check_filetype( $atts[ $fallback ], wp_get_mime_types() );
+			$url  = add_query_arg( '_', $instance, $atts[ $fallback ] );
+
+			if ( ! empty( $type['type'] ) ) {
+				$html .= sprintf( '<source type="%s" src="%s" />', $type['type'], esc_url( $url ) );
+			} else {
+				$html .= sprintf( '<source src="%s" />', esc_url( $url ) );
+			}
 		}
 	}
 
@@ -3723,9 +3728,10 @@ function wp_video_shortcode( $attr, $content = '' ) {
 		$is_youtube = ( preg_match( $yt_pattern, $atts['src'] ) );
 
 		if ( ! $is_youtube && ! $is_vimeo ) {
-			$type = wp_check_filetype( $atts['src'], wp_get_mime_types() );
+			$type          = wp_check_filetype( $atts['src'], wp_get_mime_types() );
+			$has_extension = (bool) pathinfo( wp_parse_url( $atts['src'], PHP_URL_PATH ), PATHINFO_EXTENSION );
 
-			if ( ! in_array( strtolower( $type['ext'] ), $default_types, true ) ) {
+			if ( $has_extension && ! in_array( strtolower( $type['ext'] ), $default_types, true ) ) {
 				return sprintf( '<a class="wp-embedded-video" href="%s">%s</a>', esc_url( $atts['src'] ), esc_html( $atts['src'] ) );
 			}
 		}
@@ -3845,7 +3851,6 @@ function wp_video_shortcode( $attr, $content = '' ) {
 
 	$html    = sprintf( '<video %s controls="controls">', implode( ' ', $attr_strings ) );
 	$fileurl = '';
-	$source  = '<source type="%s" src="%s" />';
 
 	foreach ( $default_types as $fallback ) {
 		if ( ! empty( $atts[ $fallback ] ) ) {
@@ -3859,8 +3864,13 @@ function wp_video_shortcode( $attr, $content = '' ) {
 			} else {
 				$type = wp_check_filetype( $atts[ $fallback ], wp_get_mime_types() );
 			}
-			$url   = add_query_arg( '_', $instance, $atts[ $fallback ] );
-			$html .= sprintf( $source, $type['type'], esc_url( $url ) );
+			$url = add_query_arg( '_', $instance, $atts[ $fallback ] );
+
+			if ( ! empty( $type['type'] ) ) {
+				$html .= sprintf( '<source type="%s" src="%s" />', $type['type'], esc_url( $url ) );
+			} else {
+				$html .= sprintf( '<source src="%s" />', esc_url( $url ) );
+			}
 		}
 	}
 
diff --git a/tests/phpunit/tests/media.php b/tests/phpunit/tests/media.php
index 060a7295f6bb4..110c3fec60321 100644
--- a/tests/phpunit/tests/media.php
+++ b/tests/phpunit/tests/media.php
@@ -962,6 +962,25 @@ public function test_wp_audio_shortcode_with_bad_attr() {
 		);
 	}
 
+	/**
+	 * Tests that a URL with no file extension (e.g. a 302 redirect) renders
+	 * an audio player instead of a plain link.
+	 *
+	 * @ticket 31689
+	 */
+	public function test_wp_audio_shortcode_with_redirect_url() {
+		$actual = wp_audio_shortcode(
+			array(
+				'src' => 'https://onedrive.live.com/download?resid=123',
+			)
+		);
+
+		$this->assertStringContainsString( '<audio', $actual, 'Should render an audio player, not a link.' );
+		$this->assertStringNotContainsString( '<a class="wp-embedded-audio"', $actual, 'Should not render a fallback link.' );
+		$this->assertStringContainsString( 'src="https://onedrive.live.com/download?resid=123', $actual, 'Source URL should be present.' );
+		$this->assertStringNotContainsString( 'type=""', $actual, 'Source tag should not have an empty type attribute.' );
+	}
+
 	/**
 	 * @ticket 35367
 	 */
@@ -1068,6 +1087,26 @@ public function test_wp_video_shortcode_with_bad_attr() {
 		);
 	}
 
+	/**
+	 * Tests that a URL with no file extension (e.g. a 302 redirect) renders
+	 * a video player instead of a plain link.
+	 *
+	 * @ticket 31689
+	 * @depends test_video_shortcode_body
+	 */
+	public function test_wp_video_shortcode_with_redirect_url() {
+		$actual = wp_video_shortcode(
+			array(
+				'src' => 'https://onedrive.live.com/download?resid=123',
+			)
+		);
+
+		$this->assertStringContainsString( '<video', $actual, 'Should render a video player, not a link.' );
+		$this->assertStringNotContainsString( '<a class="wp-embedded-video"', $actual, 'Should not render a fallback link.' );
+		$this->assertStringContainsString( 'src="https://onedrive.live.com/download?resid=123', $actual, 'Source URL should be present.' );
+		$this->assertStringNotContainsString( 'type=""', $actual, 'Source tag should not have an empty type attribute.' );
+	}
+
 	/**
 	 * @ticket 35367
 	 * @ticket 54788