Changeset 48072 for trunk/src/wp-includes/kses.php

Timestamp:

06/17/2020 03:22:49 PM (5 years ago)

Author:

swissspidy

Message:

Sitemaps: Add XML sitemaps functionality to WordPress.

While web crawlers are able to discover pages from links within the site and from other sites, XML sitemaps supplement this approach by allowing crawlers to quickly and comprehensively identify all URLs included in the sitemap and learn other signals about those URLs using the associated metadata.

See ​https://make.wordpress.org/core/2020/06/10/merge-announcement-extensible-core-sitemaps/ for more details.

This feature exposes the sitemap index via /wp-sitemap.xml and exposes a variety of new filters and hooks for developers to modify the behavior. Users can disable sitemaps completely by turning off search engine visibility in WordPress admin.

This change also introduces a new esc_xml() function to escape strings for output in XML, as well as XML support to wp_kses_normalize_entities().

Props Adrian McShane, afragen, adamsilverstein, casiepa, flixos90, garrett-eclipse, joemcgill, kburgoine, kraftbj, milana_cap, pacifika, pbiron, pfefferle, Ruxandra Gradina, swissspidy, szepeviktor, tangrufus, tweetythierry.
Fixes #50117.
See #3670. See #19998.

File:

• trunk/src/wp-includes/kses.php (modified) (4 diffs)

trunk/src/wp-includes/kses.php

@@ -48 +48 @@
 // Ensure that these variables are added to the global namespace
 // (e.g. if using namespaces / autoload in the current PHP environment).
-global $allowedposttags, $allowedtags, $allowedentitynames;
+global $allowedposttags, $allowedtags, $allowedentitynames, $allowedxmlentitynames;
 
 if ( ! CUSTOM_TAGS ) {
@@ -705 +705 @@
     );
 
+    /**
+     * @var string[] $allowedxmlentitynames Array of KSES allowed XML entitity names.
+     * @since 5.5.0
+     */
+    $allowedxmlnamedentities = array(
+        'amp',
+        'lt',
+        'gt',
+        'apos',
+        'quot',
+    );
+
     $allowedposttags = array_map( '_wp_add_global_attributes', $allowedposttags );
 } else {
@@ -1746 +1758 @@
  * `AT&T`, `:` to `:`, `&#XYZZY;` to `&#XYZZY;` and so on.
  *
+ * When `$context` is set to 'xml', HTML entities are converted to their code points.  For
+ * example, `AT&T…&#XYZZY;` is converted to `AT&T…&#XYZZY;`.
+ *
  * @since 1.0.0
- *
- * @param string $string Content to normalize entities.
+ * @since 5.5.0 Added `$context` parameter.
+ *
+ * @param string $string  Content to normalize entities.
+ * @param string $context Context for normalization. Can be either 'html' or 'xml'.
+ *                        Default 'html'.
  * @return string Content with normalized entities.
  */
-function wp_kses_normalize_entities( $string ) {
+function wp_kses_normalize_entities( $string, $context = 'html' ) {
     // Disarm all entities by converting & to &
     $string = str_replace( '&', '&', $string );
 
     // Change back the allowed entities in our entity whitelist.
-    $string = preg_replace_callback( '/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string );
+    if ( 'xml' === $context ) {
+        $string = preg_replace_callback( '/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_xml_named_entities', $string );
+    } else {
+        $string = preg_replace_callback( '/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string );
+    }
     $string = preg_replace_callback( '/&#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string );
     $string = preg_replace_callback( '/&#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string );
@@ -1785 +1807 @@
     $i = $matches[1];
     return ( ! in_array( $i, $allowedentitynames, true ) ) ? "&$i;" : "&$i;";
+}
+
+/**
+ * Callback for `wp_kses_normalize_entities()` regular expression.
+ *
+ * This function only accepts valid named entity references, which are finite,
+ * case-sensitive, and highly scrutinized by XML validators.  HTML named entity
+ * references are converted to their code points.
+ *
+ * @since 5.5.0
+ *
+ * @global array $allowedentitynames
+ * @global array $allowedxmlnamedentities
+ *
+ * @param array $matches preg_replace_callback() matches array.
+ * @return string Correctly encoded entity.
+ */
+function wp_kses_xml_named_entities( $matches ) {
+    global $allowedentitynames, $allowedxmlnamedentities;
+
+    if ( empty( $matches[1] ) ) {
+        return '';
+    }
+
+    $i = $matches[1];
+
+    if ( in_array( $i, $allowedxmlnamedentities, true ) ) {
+        return "&$i;";
+    } elseif ( in_array( $i, $allowedentitynames, true ) ) {
+        return html_entity_decode( "&$i;", ENT_HTML5 );
+    }
+
+    return "&$i;";
 }