Changeset 48132 for trunk/src/wp-includes/kses.php

Timestamp:

06/23/2020 05:05:57 AM (6 years ago)

Author:

whyisjake

Message:

Formatting: Extend wp_kses_hair and wp_kses_hair_parse to allow digits and underscores.

Fixes a lot of issues around parsing XML/HTML attributes.

Fixes #49464.

See #34406, #48608.

Props codeforest, zodiac1978, johnpgreen, dlh, ayeshrajans, johnpgreen, rilwis, travisnorthcutt, miqrogroove, chriscct7, whyisjake.

File:

• trunk/src/wp-includes/kses.php (modified) (2 diffs)

trunk/src/wp-includes/kses.php

@@ -1262 +1262 @@
                 switch ( $mode ) {
                         case 0:
-                                if ( preg_match( '/^([-a-zA-Z:]+)/', $attr, $match ) ) {
+                                if ( preg_match( '/^([_a-zA-Z][-_a-zA-Z0-9:.]*)/', $attr, $match ) ) {
                                         $attrname = $match[1];
                                         $working  = 1;
                                         $mode     = 1;
-                                        $attr     = preg_replace( '/^[-a-zA-Z:]+/', '', $attr );
+                                        $attr     = preg_replace( '/^[_a-zA-Z][-_a-zA-Z0-9:.]*/', '', $attr );
                                 }
 
@@ -1452 +1452 @@
         // phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- don't remove regex indentation
         $regex =
-        '(?:'
-        .     '[-a-zA-Z:]+'   // Attribute name.
-        . '|'
-        .     '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
-        . ')'
-        . '(?:'               // Attribute value.
-        .     '\s*=\s*'       // All values begin with '='.
-        .     '(?:'
-        .         '"[^"]*"'   // Double-quoted.
-        .     '|'
-        .         "'[^']*'"   // Single-quoted.
-        .     '|'
-        .         '[^\s"\']+' // Non-quoted.
-        .         '(?:\s|$)'  // Must have a space.
-        .     ')'
-        . '|'
-        .     '(?:\s|$)'      // If attribute has no value, space is required.
-        . ')'
-        . '\s*';              // Trailing space is optional except as mentioned above.
+                '(?:'
+                .     '[_a-zA-Z][-_a-zA-Z0-9:.]*'   // Attribute name.
+                . '|'
+                .     '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
+                . ')'
+                . '(?:'               // Attribute value.
+                .     '\s*=\s*'       // All values begin with '='.
+                .     '(?:'
+                .         '"[^"]*"'   // Double-quoted.
+                .     '|'
+                .         "'[^']*'"   // Single-quoted.
+                .     '|'
+                .         '[^\s"\']+' // Non-quoted.
+                .         '(?:\s|$)'  // Must have a space.
+                .     ')'
+                . '|'
+                .     '(?:\s|$)'      // If attribute has no value, space is required.
+                . ')'
+                . '\s*';              // Trailing space is optional except as mentioned above.
         // phpcs:enable