Make WordPress Core

Changeset 52326


Ignore:
Timestamp:
12/06/2021 11:06:40 AM (2 years ago)
Author:
SergeyBiryukov
Message:

KSES: Use the polyfilled PHP 8 string functions in _wp_kses_allow_pdf_objects():

  • str_contains()
  • str_ends_with()
  • str_starts_with()

Additionally, include a test for a PDF file in an <object> tag with an unsupported protocol.

Follow-up to [51963], [52039], [52040], [52304], [52309].

Props TobiasBg, ramonopoly.
See #54261.

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/kses.php

    r52309 r52326  
    25942594function _wp_kses_allow_pdf_objects( $url ) {
    25952595    // We're not interested in URLs that contain query strings or fragments.
    2596     if ( strpos( $url, '?' ) !== false || strpos( $url, '#' ) !== false ) {
     2596    if ( str_contains( $url, '?' ) || str_contains( $url, '#' ) ) {
    25972597        return false;
    25982598    }
    25992599
    26002600    // If it doesn't have a PDF extension, it's not safe.
    2601     if ( 0 !== substr_compare( $url, '.pdf', -4, 4, true ) ) {
     2601    if ( ! str_ends_with( $url, '.pdf' ) ) {
    26022602        return false;
    26032603    }
     
    26082608    $upload_host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
    26092609    $upload_port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
    2610     if ( 0 === strpos( $url, "http://$upload_host$upload_port/" ) || 0 === strpos( $url, "https://$upload_host$upload_port/" ) ) {
     2610
     2611    if ( str_starts_with( $url, "http://$upload_host$upload_port/" )
     2612        || str_starts_with( $url, "https://$upload_host$upload_port/" )
     2613    ) {
    26112614        return true;
    26122615    }
  • trunk/tests/phpunit/tests/kses.php

    r52309 r52326  
    15891589                '',
    15901590            ),
    1591             'protocol relative url'                   => array(
     1591            'protocol-relative url'                   => array(
    15921592                '<object type="application/pdf" data="//example.org/foo.pdf" />',
     1593                '',
     1594            ),
     1595            'unsupported protocol'                    => array(
     1596                '<object type="application/pdf" data="ftp://example.org/foo.pdf" />',
    15931597                '',
    15941598            ),
Note: See TracChangeset for help on using the changeset viewer.