Changeset 38785 for trunk/tests/phpunit/tests/kses.php

Timestamp:

10/13/2016 10:24:27 PM (8 years ago)

Author:

pento

Message:

KSES: Deprecate wp_kses_js_entities().

This function was originally introduced to fix an XSS attack in Netscape 4, which never affected any other browsers, or later versions of Netscape.

I'm willing to go out on a limb, and say that we've officially dropped security support for Netscape 4.

Props dmsnell, desrosj.
Fixes #33848.

File:

• trunk/tests/phpunit/tests/kses.php (modified) (1 diff)

trunk/tests/phpunit/tests/kses.php

@@ -196 +196 @@
             switch ( $attack->name ) {
                 case 'XSS Locator':
-                    $this->assertEquals('\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//-->">\'>alert(String.fromCharCode(88,83,83))=', $result);
+                    $this->assertEquals('\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//-->">\'>alert(String.fromCharCode(88,83,83))=&{}', $result);
                     break;
                 case 'XSS Quick Test':
-                    $this->assertEquals('\'\';!--"=', $result);
+                    $this->assertEquals('\'\';!--"=&{()}', $result);
                     break;
                 case 'SCRIPT w/Alert()':