Changeset 38785 for trunk/src/wp-includes/kses.php

Timestamp:

10/13/2016 10:24:27 PM (8 years ago)

Author:

pento

Message:

KSES: Deprecate wp_kses_js_entities().

This function was originally introduced to fix an XSS attack in Netscape 4, which never affected any other browsers, or later versions of Netscape.

I'm willing to go out on a limb, and say that we've officially dropped security support for Netscape 4.

Props dmsnell, desrosj.
Fixes #33848.

File:

• trunk/src/wp-includes/kses.php (modified) (3 diffs)

trunk/src/wp-includes/kses.php

@@ -528 +528 @@
         $allowed_protocols = wp_allowed_protocols();
     $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
-    $string = wp_kses_js_entities($string);
     $string = wp_kses_normalize_entities($string);
     $string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook
@@ -551 +550 @@
     $allowed_protocols = wp_allowed_protocols();
     $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
-    $string = wp_kses_js_entities( $string );
     
     // Preserve leading and trailing whitespace.
@@ -1297 +1295 @@
 
 /**
- * Removes the HTML JavaScript entities found in early versions of Netscape 4.
- *
- * @since 1.0.0
- *
- * @param string $string
- * @return string
- */
-function wp_kses_js_entities($string) {
-    return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string);
-}
-
-/**
  * Handles parsing errors in wp_kses_hair().
  *