Changeset 52326

Timestamp:

12/06/2021 11:06:40 AM (3 years ago)

Author:

SergeyBiryukov

Message:

KSES: Use the polyfilled PHP 8 string functions in _wp_kses_allow_pdf_objects():

• str_contains()
• str_ends_with()
• str_starts_with()

Additionally, include a test for a PDF file in an <object> tag with an unsupported protocol.

Follow-up to [51963], [52039], [52040], [52304], [52309].

Props TobiasBg, ramonopoly.
See #54261.

Location:

trunk

Files:

• src/wp-includes/kses.php (modified) (2 diffs)
• tests/phpunit/tests/kses.php (modified) (1 diff)

trunk/src/wp-includes/kses.php

@@ -2594 +2594 @@
 function _wp_kses_allow_pdf_objects( $url ) {
     // We're not interested in URLs that contain query strings or fragments.
-    if ( strpos( $url, '?' ) !== false || strpos( $url, '#' ) !== false ) {
+    if ( str_contains( $url, '?' ) || str_contains( $url, '#' ) ) {
         return false;
     }
 
     // If it doesn't have a PDF extension, it's not safe.
-    if ( 0 !== substr_compare( $url, '.pdf', -4, 4, true ) ) {
+    if ( ! str_ends_with( $url, '.pdf' ) ) {
         return false;
     }
@@ -2608 +2608 @@
     $upload_host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
     $upload_port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
-    if ( 0 === strpos( $url, "http://$upload_host$upload_port/" ) || 0 === strpos( $url, "https://$upload_host$upload_port/" ) ) {
+
+    if ( str_starts_with( $url, "http://$upload_host$upload_port/" )
+        || str_starts_with( $url, "https://$upload_host$upload_port/" )
+    ) {
         return true;
     }

trunk/tests/phpunit/tests/kses.php

@@ -1589 +1589 @@
                 '',
             ),
-            'protocol relative url'                   => array(
+            'protocol-relative url'                   => array(
                 '<object type="application/pdf" data="//example.org/foo.pdf" />',
+                '',
+            ),
+            'unsupported protocol'                    => array(
+                '<object type="application/pdf" data="ftp://example.org/foo.pdf" />',
                 '',
             ),