Changeset 52326

Timestamp:

12/06/2021 11:06:40 AM (5 years ago)

Author:

SergeyBiryukov

Message:

KSES: Use the polyfilled PHP 8 string functions in _wp_kses_allow_pdf_objects():

• str_contains()
• str_ends_with()
• str_starts_with()

Additionally, include a test for a PDF file in an <object> tag with an unsupported protocol.

Follow-up to [51963], [52039], [52040], [52304], [52309].

Props TobiasBg, ramonopoly.
See #54261.

Location:

trunk

Files:

• src/wp-includes/kses.php (modified) (2 diffs)
• tests/phpunit/tests/kses.php (modified) (1 diff)

trunk/src/wp-includes/kses.php

@@ -2594 +2594 @@
 function _wp_kses_allow_pdf_objects( $url ) {
         // We're not interested in URLs that contain query strings or fragments.
-        if ( strpos( $url, '?' ) !== false || strpos( $url, '#' ) !== false ) {
+        if ( str_contains( $url, '?' ) || str_contains( $url, '#' ) ) {
                 return false;
         }
 
         // If it doesn't have a PDF extension, it's not safe.
-        if ( 0 !== substr_compare( $url, '.pdf', -4, 4, true ) ) {
+        if ( ! str_ends_with( $url, '.pdf' ) ) {
                 return false;
         }
@@ -2608 +2608 @@
         $upload_host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
         $upload_port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
-        if ( 0 === strpos( $url, "http://$upload_host$upload_port/" ) || 0 === strpos( $url, "https://$upload_host$upload_port/" ) ) {
+
+        if ( str_starts_with( $url, "http://$upload_host$upload_port/" )
+                || str_starts_with( $url, "https://$upload_host$upload_port/" )
+        ) {
                 return true;
         }

trunk/tests/phpunit/tests/kses.php

@@ -1589 +1589 @@
                                 '',
                         ),
-                        'protocol relative url'                   => array(
+                        'protocol-relative url'                   => array(
                                 '<object type="application/pdf" data="//example.org/foo.pdf" />',
+                                '',
+                        ),
+                        'unsupported protocol'                    => array(
+                                '<object type="application/pdf" data="ftp://example.org/foo.pdf" />',
                                 '',
                         ),