Changeset 38785 for trunk/src/wp-includes/deprecated.php

Timestamp:

10/13/2016 10:24:27 PM (8 years ago)

Author:

pento

Message:

KSES: Deprecate wp_kses_js_entities().

This function was originally introduced to fix an XSS attack in Netscape 4, which never affected any other browsers, or later versions of Netscape.

I'm willing to go out on a limb, and say that we've officially dropped security support for Netscape 4.

Props dmsnell, desrosj.
Fixes #33848.

File:

• trunk/src/wp-includes/deprecated.php (modified) (1 diff)

trunk/src/wp-includes/deprecated.php

@@ -3773 +3773 @@
     return get_query_template( 'paged' );
 }
+
+/**
+ * Removes the HTML JavaScript entities found in early versions of Netscape 4.
+ *
+ * Previously, this function was pulled in from the original
+ * import of kses and removed a specific vulnerability only
+ * existent in early version of Netscape 4. However, this
+ * vulnerability never affected any other browsers and can
+ * be considered safe for the modern web.
+ *
+ * The regular expression which sanitized this vulnerability
+ * has been removed in consideration of the performance and
+ * energy demands it placed, now merely passing through its
+ * input to the return.
+ *
+ * @since 1.0.0
+ * @deprecated deprecated since 4.7
+ *
+ * @param string $string
+ * @return string
+ */
+function wp_kses_js_entities( $string ) {
+    _deprecated_function( __FUNCTION__, '4.7.0' );
+
+    return preg_replace( '%&\s*\{[^}]*(\}\s*;?|$)%', '', $string );
+}