Issue: [4.1 Beta 4] URL bbcode in template parameter can produce malformed link if URL option is not wrapped in quotes

Merged with https://www.vaultwiki.org/issues/5805/
The example you posted is easier to reproduce and more visually apparent. Based on my understanding of the underlying issue, this occurs whenever a template parameter is used in the option value of any BB-Code, where that BB-Code's option is not wrapped in quotes.

This is because in the absence of quotes, the option is expected to end at the next closing bracket ].
When there is a nested BB-Code in the option, the nested BB-Code's closing bracket occurs first, which causes problems.
Even if a template parameter contains only text and no BB-Codes, it still might contain BB-Codes in a different usage of the template. Also, all template parameters are turned into fake BB-Codes anyway where the replacement HTML is the parsed value of the content that was entered into the template call.

Thus, best practice would be to quote-wrap any BB-Code options in templates if those options use template parameters.

We may be able to work around this issue by trying to catch when a valid tag appears in a BB-Code option, and assuming that the tag option has not completed in that case. This may be easier to achieve in some platforms than others, if possible at all. This may be a technical limitation.

Thank you for taking the time to explain the suspected cause of this issue.

Yes, this seems like good advice - I'll be paying more careful attention to existing templates that don't currently wrap quotations around the BB code option values.

It is worth mentioning that this issue has only come to light after upgrading my public site to VW4.1 Beta 4 (XF2.1 version). I don't recall this happening with VW4.0 (XF1.5 version), and an archive.org site snapshot confirms this. Other customer sites that make the same transition may begin to experience this issue in some of their existing templates without them realising it.

It broke our infobox templates in the migration, as highlighted in the merged ticket.

This is fixed in the next release. When parsing a template, when locating BB-Code options within that template that are not wrapped in quotes, the BB-Code parser will double-check that new tags opened within the option were already closed, before deciding that the option has closed. The issue had only affected XenForo 2.

Note: Within templates, this fix may interfere with other third-party add-ons, because it replaces a core XenForo method in that context.