Input validation for shortcode block

[iamgabrielma]

Describe the bug

If we add an URL into the shortcode block, it accepts it and the link is displayed in the site front-end.

To Reproduce
Steps to reproduce the behavior:

1. Create a shortcode block
2. Add an URL in the text field
3. Publish

Expected behavior
To get some error message when something that is not a shortcode is added.

Screenshots

Back-end:

Front-end:

Desktop (please complete the following information):

• OS: El Capitan 10.11.6
• Browser Firefox 62.0.3
• Gutenberg 4.0

Additional context

Reported originally in the comments on #7357 when I was testing something else

[swissspidy]

As mentioned in #7357 (comment), do_shortcode() won't do anything to a non-shortcode string like that, but the URL is picked up by the WordPress embed handler and turns it into a proper embed.

[t-hamano]

From my understanding, I don't think this is an issue specific to the Shortcode block or Gutenberg. For example, in the Classic Editor, you can simply enter a URL that is allowed as an oEmbed provider and it will be converted to embedded content in the front end.

I think this is expected behavior in WP core, so I'll close this issue, but if there's anything I've missed, please comment.