Ticket #37698: 37698.diff

tests/phpunit/tests/kses.php

@@ -1046 +1046 @@
                 );
         }
 
+        function test_wp_kses_split_global_pollution() {
+                $func = function ( $attributes ) {
+                        wp_kses_split( '', [], [] ); // this triggers the bug
+                        return $attributes;
+                };
+                add_filter( 'safe_style_css', $func );
+
+                $expected = "<a style='color: red'>I link this</a>";
+                $result   = wp_kses_split( "<a style='color: red;'>I link this</a>", array( 'a' => array( 'style' => array() ) ), array( 'http' ) );
+                $this->assertEquals( $expected, $result );
+        }
+
         /**
          * Test URL sanitization in the style tag.
          *

src/wp-includes/kses.php

@@ -941 +941 @@
  * @return string Content with fixed HTML tags
  */
 function wp_kses_split( $string, $allowed_html, $allowed_protocols ) {
-        global $pass_allowed_html, $pass_allowed_protocols;
-        $pass_allowed_html      = $allowed_html;
-        $pass_allowed_protocols = $allowed_protocols;
-        return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $string );
+        return preg_replace_callback(
+                '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%',
+                function ( $match ) use ( $allowed_html, $allowed_protocols ) {
+                        return wp_kses_split2( $match[0], $allowed_html, $allowed_protocols );
+                },
+                $string
+        );
 }
 
 /**
@@ -998 +1001 @@
 }
 
 /**
- * Callback for `wp_kses_split()`.
- *
- * @since 3.1.0
- * @access private
- * @ignore
- *
- * @global array $pass_allowed_html
- * @global array $pass_allowed_protocols
- *
- * @return string
- */
-function _wp_kses_split_callback( $match ) {
-        global $pass_allowed_html, $pass_allowed_protocols;
-        return wp_kses_split2( $match[0], $pass_allowed_html, $pass_allowed_protocols );
-}
-
-/**
  * Callback for `wp_kses_split()` for fixing malformed HTML tags.
  *
  * This function does a lot of work. It rejects some very malformed things like