Changeset 38785

Timestamp:

10/13/2016 10:24:27 PM (8 years ago)

Author:

pento

Message:

KSES: Deprecate wp_kses_js_entities().

This function was originally introduced to fix an XSS attack in Netscape 4, which never affected any other browsers, or later versions of Netscape.

I'm willing to go out on a limb, and say that we've officially dropped security support for Netscape 4.

Props dmsnell, desrosj.
Fixes #33848.

Location:

trunk

Files:

• src/wp-includes/deprecated.php (modified) (1 diff)
• src/wp-includes/kses.php (modified) (3 diffs)
• tests/phpunit/tests/kses.php (modified) (1 diff)

trunk/src/wp-includes/deprecated.php

@@ -3773 +3773 @@
     return get_query_template( 'paged' );
 }
+
+/**
+ * Removes the HTML JavaScript entities found in early versions of Netscape 4.
+ *
+ * Previously, this function was pulled in from the original
+ * import of kses and removed a specific vulnerability only
+ * existent in early version of Netscape 4. However, this
+ * vulnerability never affected any other browsers and can
+ * be considered safe for the modern web.
+ *
+ * The regular expression which sanitized this vulnerability
+ * has been removed in consideration of the performance and
+ * energy demands it placed, now merely passing through its
+ * input to the return.
+ *
+ * @since 1.0.0
+ * @deprecated deprecated since 4.7
+ *
+ * @param string $string
+ * @return string
+ */
+function wp_kses_js_entities( $string ) {
+    _deprecated_function( __FUNCTION__, '4.7.0' );
+
+    return preg_replace( '%&\s*\{[^}]*(\}\s*;?|$)%', '', $string );
+}

trunk/src/wp-includes/kses.php

@@ -528 +528 @@
         $allowed_protocols = wp_allowed_protocols();
     $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
-    $string = wp_kses_js_entities($string);
     $string = wp_kses_normalize_entities($string);
     $string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook
@@ -551 +550 @@
     $allowed_protocols = wp_allowed_protocols();
     $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
-    $string = wp_kses_js_entities( $string );
     
     // Preserve leading and trailing whitespace.
@@ -1297 +1295 @@
 
 /**
- * Removes the HTML JavaScript entities found in early versions of Netscape 4.
- *
- * @since 1.0.0
- *
- * @param string $string
- * @return string
- */
-function wp_kses_js_entities($string) {
-    return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string);
-}
-
-/**
  * Handles parsing errors in wp_kses_hair().
  *

trunk/tests/phpunit/tests/kses.php

@@ -196 +196 @@
             switch ( $attack->name ) {
                 case 'XSS Locator':
-                    $this->assertEquals('\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//-->">\'>alert(String.fromCharCode(88,83,83))=', $result);
+                    $this->assertEquals('\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//-->">\'>alert(String.fromCharCode(88,83,83))=&{}', $result);
                     break;
                 case 'XSS Quick Test':
-                    $this->assertEquals('\'\';!--"=', $result);
+                    $this->assertEquals('\'\';!--"=&{()}', $result);
                     break;
                 case 'SCRIPT w/Alert()':