[#47746] - Fix: Skip email cloaking inside JSON-LD script blocks (#47743)
- Closed
- 9 May 2026
- Medium
- Build: 5.4-dev
- # 47746
- Diff
- jiteshkhatri11:5.4-dev
User tests: Successful: Unsuccessful:
Pull Request resolves #47743
- I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.
Summary of Changes
The Email Cloaking plugin (plg_content_emailcloak) was applying its
email replacement logic to the entire page output without excluding
<script type="application/ld+json"> blocks.
As a result, email addresses present in JSON-LD structured data were
being replaced with HTML Web Component markup (<joomla-hidden-mail ...>),
which produces syntactically invalid JSON. This causes JSON parse errors
such as "Missing ',' or '}' after property value" when the structured
data is parsed by search engines or validation tools like Google's
Rich Results Test.
Changes made:
- In
plugins/content/emailcloak/src/Extension/EmailCloak.php, inside
thecloak()method, all<script type="application/ld+json">blocks
are now temporarily replaced with unique placeholders before the email
cloaking regex runs. - After all cloaking operations are complete, the original JSON-LD blocks
are restored exactly as they were. - This approach is fully non-breaking — all email addresses outside
JSON-LD blocks continue to be cloaked as before.
Testing Instructions
- Install Joomla and enable the Email Cloaking plugin
- Create an article or module that outputs a JSON-LD block, for example:
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "Organization",
"email": "info@example.com"
}
</script>- Also place a visible email address in the article body:
info@example.com - View the page in a browser and check the page source
- Verify the email inside the JSON-LD block is NOT cloaked ✅
- Verify the email in the article body IS cloaked ✅
- Validate the JSON-LD using Google Rich Results Test — no errors should appear ✅
Actual result BEFORE applying this Pull Request
Email addresses inside <script type="application/ld+json"> blocks
were replaced with HTML markup, producing invalid JSON and causing
Schema.org structured data validation errors.
Expected result AFTER applying this Pull Request
Email addresses inside JSON-LD blocks are preserved exactly as written.
All other email addresses on the page are still cloaked normally.
JSON-LD structured data remains valid and parseable by search engines.
Link to documentations
- No documentation changes for guide.joomla.org needed
- No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Front End Plugins |
I cannot replicate the issue before patch.
Using the person schema, the output in the sourcecode is something like ,
"name":"meins","url":"https://example.org","email":"kontakt@example.or","address":{"@type":"PostalAddress","addressLo ...
I cannot replicate the issue before patch.
Using the person schema, the output in the sourcecode is something like ,
"name":"meins","url":"https://example.org","email":"kontakt@example.org","address":{"@type":"PostalAddress","addressLo ...
Here is what I get with the plugin enabled:
| Labels |
Added:
PR-5.4-dev
|
||
Fixed the PHP code style issue (missing newline at end of file).
Regarding the testing feedback from @chmst and @brianteeman — the issue
may depend on how the JSON-LD block is output on the page. @01Kuzma
confirmed the bug is reproducible.
The fix is safe and non-breaking — it only skips JSON-LD script blocks
and does not change behaviour for any other email addresses on the page.
Regarding the testing feedback from @chmst and @brianteeman — the issue
may depend on how the JSON-LD block is output on the page. @01Kuzma
confirmed the bug is reproducible.
so please show us how to replicate the bug. If we cant replicate the bug then we cant test that this code change fixes anything
@brianteeman thank you for your feedback and for taking the time to test.
Here are the exact steps to reproduce the issue:
- Enable the Email Cloaking plugin
- Create an article and switch to HTML source mode in the editor
- Add this JSON-LD block directly in the article:
- Save the article and view it on the frontend
- Right click the page and select View Page Source
- Search for application/ld+json in the source
- The email address inside the JSON-LD block will be replaced
with HTML markup making the JSON invalid
@01Kuzma has already confirmed this behaviour with a screenshot.
I hope this helps to reproduce the issue. Please let me know if
you need any further information.
@01Kuzma please provide the exact steps you took and which schema you were using
I use YooTheme pro builder and I insert raw code into HTML component, for example, this one:
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "Organization",
...
"email": "my@email.com",
...
"logo": {
"@type": "ImageObject",
"url": "https://...logo.png"
},
"address": {...
},...
]
}
</script>
Not surprised it breaks for you then as you're not using the provided schema plugins. You should never be inserting scripts directly in the article. This pr is fixing user errors and should not be accepted
Not surprised it breaks for you then as you're not using the provided schema plugins. You should never be inserting scripts directly in the article. This pr is fixing user errors and should not be accepted
Schema plugins are very limited in many use cases. They are good only for very basic usage
by default you cant even paste the code you suggested into joomla content as it strips out any scripts.
| Status | Pending | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2026-05-09 13:33:36 |
| Closed_By | ⇒ | chmst |
Closing this as it is no issue of the Joomla core.
I cannot replicate the issue befor patch.
Using the person schema, the output in the sourcecode is something like ,
"name":"meins","url":"https://example.org","email":"kontakt@example.or","address":{"@type":"PostalAddress","addressLo ...