Changeset 48132

Timestamp:

06/23/2020 05:05:57 AM (4 years ago)

Author:

whyisjake

Message:

Formatting: Extend wp_kses_hair and wp_kses_hair_parse to allow digits and underscores.

Fixes a lot of issues around parsing XML/HTML attributes.

Fixes #49464.

See #34406, #48608.

Props codeforest, zodiac1978, johnpgreen, dlh, ayeshrajans, johnpgreen, rilwis, travisnorthcutt, miqrogroove, chriscct7, whyisjake.

Location:

trunk

Files:

• src/wp-includes/kses.php (modified) (2 diffs)
• tests/phpunit/tests/kses.php (modified) (1 diff)

trunk/src/wp-includes/kses.php

@@ -1262 +1262 @@
         switch ( $mode ) {
             case 0:
-                if ( preg_match( '/^([-a-zA-Z:]+)/', $attr, $match ) ) {
+                if ( preg_match( '/^([_a-zA-Z][-_a-zA-Z0-9:.]*)/', $attr, $match ) ) {
                     $attrname = $match[1];
                     $working  = 1;
                     $mode     = 1;
-                    $attr     = preg_replace( '/^[-a-zA-Z:]+/', '', $attr );
+                    $attr     = preg_replace( '/^[_a-zA-Z][-_a-zA-Z0-9:.]*/', '', $attr );
                 }
 
@@ -1452 +1452 @@
     // phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- don't remove regex indentation
     $regex =
-    '(?:'
-    .     '[-a-zA-Z:]+'   // Attribute name.
-    . '|'
-    .     '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
-    . ')'
-    . '(?:'               // Attribute value.
-    .     '\s*=\s*'       // All values begin with '='.
-    .     '(?:'
-    .         '"[^"]*"'   // Double-quoted.
-    .     '|'
-    .         "'[^']*'"   // Single-quoted.
-    .     '|'
-    .         '[^\s"\']+' // Non-quoted.
-    .         '(?:\s|$)'  // Must have a space.
-    .     ')'
-    . '|'
-    .     '(?:\s|$)'      // If attribute has no value, space is required.
-    . ')'
-    . '\s*';              // Trailing space is optional except as mentioned above.
+        '(?:'
+        .     '[_a-zA-Z][-_a-zA-Z0-9:.]*'   // Attribute name.
+        . '|'
+        .     '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
+        . ')'
+        . '(?:'               // Attribute value.
+        .     '\s*=\s*'       // All values begin with '='.
+        .     '(?:'
+        .         '"[^"]*"'   // Double-quoted.
+        .     '|'
+        .         "'[^']*'"   // Single-quoted.
+        .     '|'
+        .         '[^\s"\']+' // Non-quoted.
+        .         '(?:\s|$)'  // Must have a space.
+        .     ')'
+        . '|'
+        .     '(?:\s|$)'      // If attribute has no value, space is required.
+        . ')'
+        . '\s*';              // Trailing space is optional except as mentioned above.
     // phpcs:enable
 

trunk/tests/phpunit/tests/kses.php

@@ -630 +630 @@
                 false,
             ),
+            // using digit in attribute name should work
+            array(
+                'href="https://example.com/[shortcode attr=\'value\']" data-op3-timer-seconds="0"',
+                array( 'href="https://example.com/[shortcode attr=\'value\']" ', 'data-op3-timer-seconds="0"' ),
+            ),
+            // using underscore in attribute name should work
+            array(
+                'href="https://example.com/[shortcode attr=\'value\']" data-op_timer-seconds="0"',
+                array( 'href="https://example.com/[shortcode attr=\'value\']" ', 'data-op_timer-seconds="0"' ),
+            ),
+            // using period in attribute name should work
+            array(
+                'href="https://example.com/[shortcode attr=\'value\']" data-op.timer-seconds="0"',
+                array( 'href="https://example.com/[shortcode attr=\'value\']" ', 'data-op.timer-seconds="0"' ),
+            ),
+            // using digit at a beginning of attribute name should return false
+            array(
+                'href="https://example.com/[shortcode attr=\'value\']" 3data-op-timer-seconds="0"',
+                false,
+            ),
         );
     }