WordPress.org
Get WordPress

Make WordPress Core

Changeset 54933


Ignore:
Timestamp:
12/05/2022 01:55:20 PM (4 years ago)
Author:
SergeyBiryukov
Message:

Code Modernization: Rename parameters that use reserved keywords in wp-includes/kses.php.

While using reserved PHP keywords as parameter name labels is allowed, in the context of function calls using named parameters in PHP 8.0+, this will easily lead to confusion. To avoid that, it is recommended not to use reserved keywords as function parameter names.

This commit:

  • Renames the $string parameter to $content in:
    • wp_kses()
    • wp_kses_hook()
    • wp_kses_split()
    • wp_kses_split2()
    • wp_kses_bad_protocol()
    • wp_kses_no_null()
    • wp_kses_stripslashes()
    • wp_kses_bad_protocol_once()
    • wp_kses_normalize_entities()
    • wp_kses_decode_entities()
  • Renames the $string parameter to $attr in:
    • wp_kses_one_attr()
    • wp_kses_html_error()
  • Renames the $match parameter to $matches in:
    • _wp_kses_split_callback()
    • _wp_kses_decode_entities_chr()
    • _wp_kses_decode_entities_chr_hexdec()
  • Renames the $string parameter to $scheme in wp_kses_bad_protocol_once2().

Follow-up to [52946], [52996], [52997], [52998], [53003], [53014], [53029], [53039], [53116], [53117], [53137], [53174], [53184], [53185], [53192], [53193], [53198], [53203], [53207], [53215], [53216], [53220], [53230], [53232], [53236], [53239], [53240], [53242], [53243], [53245], [53246], [53257], [53269], [53270], [53271], [53272], [53273], [53274], [53275], [53276], [53277], [53281], [53283], [53284], [53285], [53287], [53364], [53365], [54927], [54929], [54930], [54931], [54932].

Props jrf, aristath, poena, justinahinon, SergeyBiryukov.
See #56788.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/wp-includes/kses.php

    r54698 r54933  
    737737 * @since 1.0.0
    738738 *
    739  * @param string         $string            Text content to filter.
     739 * @param string         $content           Text content to filter.
    740740 * @param array[]|string $allowed_html      An array of allowed HTML elements and attributes,
    741741 *                                          or a context name such as 'post'. See wp_kses_allowed_html()
    … …  
    745745 * @return string Filtered content containing only the allowed HTML.
    746746 */
    747 function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
     747function wp_kses( $content, $allowed_html, $allowed_protocols = array() ) {
    748748        if ( empty( $allowed_protocols ) ) {
    749749                $allowed_protocols = wp_allowed_protocols();
    750750        }
    751751
    752         $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
    753         $string = wp_kses_normalize_entities( $string );
    754         $string = wp_kses_hook( $string, $allowed_html, $allowed_protocols );
    755 
    756         return wp_kses_split( $string, $allowed_html, $allowed_protocols );
     752        $content = wp_kses_no_null( $content, array( 'slash_zero' => 'keep' ) );
     753        $content = wp_kses_normalize_entities( $content );
     754        $content = wp_kses_hook( $content, $allowed_html, $allowed_protocols );
     755
     756        return wp_kses_split( $content, $allowed_html, $allowed_protocols );
    757757}
    758758
    … …  
    764764 * @since 4.2.3
    765765 *
    766  * @param string $string  The 'whole' attribute, including name and value.
     766 * @param string $attr    The 'whole' attribute, including name and value.
    767767 * @param string $element The HTML element name to which the attribute belongs.
    768768 * @return string Filtered attribute.
    769769 */
    770 function wp_kses_one_attr( $string, $element ) {
     770function wp_kses_one_attr( $attr, $element ) {
    771771        $uris              = wp_kses_uri_attributes();
    772772        $allowed_html      = wp_kses_allowed_html( 'post' );
    773773        $allowed_protocols = wp_allowed_protocols();
    774         $string            = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
     774        $attr              = wp_kses_no_null( $attr, array( 'slash_zero' => 'keep' ) );
    775775
    776776        // Preserve leading and trailing whitespace.
    777777        $matches = array();
    778         preg_match( '/^\s*/', $string, $matches );
     778        preg_match( '/^\s*/', $attr, $matches );
    779779        $lead = $matches[0];
    780         preg_match( '/\s*$/', $string, $matches );
     780        preg_match( '/\s*$/', $attr, $matches );
    781781        $trail = $matches[0];
    782782        if ( empty( $trail ) ) {
    783                 $string = substr( $string, strlen( $lead ) );
     783                $attr = substr( $attr, strlen( $lead ) );
    784784        } else {
    785                 $string = substr( $string, strlen( $lead ), -strlen( $trail ) );
     785                $attr = substr( $attr, strlen( $lead ), -strlen( $trail ) );
    786786        }
    787787
    788788        // Parse attribute name and value from input.
    789         $split = preg_split( '/\s*=\s*/', $string, 2 );
     789        $split = preg_split( '/\s*=\s*/', $attr, 2 );
    790790        $name  = $split[0];
    791791        if ( count( $split ) == 2 ) {
    … …  
    793793
    794794                // Remove quotes surrounding $value.
    795                 // Also guarantee correct quoting in $string for this one attribute.
     795                // Also guarantee correct quoting in $attr for this one attribute.
    796796                if ( '' === $value ) {
    797797                        $quote = '';
    … …  
    816816                }
    817817
    818                 $string = "$name=$quote$value$quote";
    819                 $vless  = 'n';
     818                $attr = "$name=$quote$value$quote";
     819                $vless = 'n';
    820820        } else {
    821821                $value = '';
    … …  
    824824
    825825        // Sanitize attribute by name.
    826         wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html );
     826        wp_kses_attr_check( $name, $value, $attr, $vless, $element, $allowed_html );
    827827
    828828        // Restore whitespace.
    829         return $lead . $string . $trail;
     829        return $lead . $attr . $trail;
    830830}
    831831
    … …  
    923923 * @since 1.0.0
    924924 *
    925  * @param string         $string            Content to filter through KSES.
     925 * @param string         $content           Content to filter through KSES.
    926926 * @param array[]|string $allowed_html      An array of allowed HTML elements and attributes,
    927927 *                                          or a context name such as 'post'. See wp_kses_allowed_html()
    … …  
    930930 * @return string Filtered content through {@see 'pre_kses'} hook.
    931931 */
    932 function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) {
     932function wp_kses_hook( $content, $allowed_html, $allowed_protocols ) {
    933933        /**
    934934         * Filters content to be run through KSES.
    … …  
    936936         * @since 2.3.0
    937937         *
    938          * @param string         $string            Content to filter through KSES.
     938         * @param string         $content           Content to filter through KSES.
    939939         * @param array[]|string $allowed_html      An array of allowed HTML elements and attributes,
    940940         *                                          or a context name such as 'post'. See wp_kses_allowed_html()
    … …  
    942942         * @param string[]       $allowed_protocols Array of allowed URL protocols.
    943943         */
    944         return apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols );
     944        return apply_filters( 'pre_kses', $content, $allowed_html, $allowed_protocols );
    945945}
    946946
    … …  
    967967 * @global string[]       $pass_allowed_protocols Array of allowed URL protocols.
    968968 *
    969  * @param string         $string            Content to filter.
     969 * @param string         $content           Content to filter.
    970970 * @param array[]|string $allowed_html      An array of allowed HTML elements and attributes,
    971971 *                                          or a context name such as 'post'. See wp_kses_allowed_html()
    … …  
    974974 * @return string Content with fixed HTML tags
    975975 */
    976 function wp_kses_split( $string, $allowed_html, $allowed_protocols ) {
     976function wp_kses_split( $content, $allowed_html, $allowed_protocols ) {
    977977        global $pass_allowed_html, $pass_allowed_protocols;
    978978
    … …  
    980980        $pass_allowed_protocols = $allowed_protocols;
    981981
    982         return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $string );
     982        return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $content );
    983983}
    984984
    … …  
    10441044 * @global string[]       $pass_allowed_protocols Array of allowed URL protocols.
    10451045 *
    1046  * @param array $match preg_replace regexp matches
     1046 * @param array $matches preg_replace regexp matches
    10471047 * @return string
    10481048 */
    1049 function _wp_kses_split_callback( $match ) {
     1049function _wp_kses_split_callback( $matches ) {
    10501050        global $pass_allowed_html, $pass_allowed_protocols;
    10511051
    1052         return wp_kses_split2( $match[0], $pass_allowed_html, $pass_allowed_protocols );
     1052        return wp_kses_split2( $matches[0], $pass_allowed_html, $pass_allowed_protocols );
    10531053}
    10541054
    … …  
    10691069 * @since 1.0.0
    10701070 *
    1071  * @param string         $string            Content to filter.
     1071 * @param string         $content           Content to filter.
    10721072 * @param array[]|string $allowed_html      An array of allowed HTML elements and attributes,
    10731073 *                                          or a context name such as 'post'. See wp_kses_allowed_html()
    … …  
    10761076 * @return string Fixed HTML element
    10771077 */
    1078 function wp_kses_split2( $string, $allowed_html, $allowed_protocols ) {
    1079         $string = wp_kses_stripslashes( $string );
     1078function wp_kses_split2( $content, $allowed_html, $allowed_protocols ) {
     1079        $content = wp_kses_stripslashes( $content );
    10801080
    10811081        // It matched a ">" character.
    1082         if ( '<' !== substr( $string, 0, 1 ) ) {
     1082        if ( '<' !== substr( $content, 0, 1 ) ) {
    10831083                return '&gt;';
    10841084        }
    10851085
    10861086        // Allow HTML comments.
    1087         if ( '<!--' === substr( $string, 0, 4 ) ) {
    1088                 $string = str_replace( array( '<!--', '-->' ), '', $string );
    1089                 while ( ( $newstring = wp_kses( $string, $allowed_html, $allowed_protocols ) ) != $string ) {
    1090                         $string = $newstring;
     1087        if ( '<!--' === substr( $content, 0, 4 ) ) {
     1088                $content = str_replace( array( '<!--', '-->' ), '', $content );
     1089                while ( ( $newstring = wp_kses( $content, $allowed_html, $allowed_protocols ) ) != $content ) {
     1090                        $content = $newstring;
    10911091                }
    1092                 if ( '' === $string ) {
     1092                if ( '' === $content ) {
    10931093                        return '';
    10941094                }
    10951095                // Prevent multiple dashes in comments.
    1096                 $string = preg_replace( '/--+/', '-', $string );
     1096                $content = preg_replace( '/--+/', '-', $content );
    10971097                // Prevent three dashes closing a comment.
    1098                 $string = preg_replace( '/-$/', '', $string );
    1099                 return "<!--{$string}-->";
     1098                $content = preg_replace( '/-$/', '', $content );
     1099                return "<!--{$content}-->";
    11001100        }
    11011101
    11021102        // It's seriously malformed.
    1103         if ( ! preg_match( '%^<\s*(/\s*)?([a-zA-Z0-9-]+)([^>]*)>?$%', $string, $matches ) ) {
     1103        if ( ! preg_match( '%^<\s*(/\s*)?([a-zA-Z0-9-]+)([^>]*)>?$%', $content, $matches ) ) {
    11041104                return '';
    11051105        }
    … …  
    16821682 * @since 1.0.0
    16831683 *
    1684  * @param string   $string            Content to filter bad protocols from.
     1684 * @param string   $content           Content to filter bad protocols from.
    16851685 * @param string[] $allowed_protocols Array of allowed URL protocols.
    16861686 * @return string Filtered content.
    16871687 */
    1688 function wp_kses_bad_protocol( $string, $allowed_protocols ) {
    1689         $string     = wp_kses_no_null( $string );
     1688function wp_kses_bad_protocol( $content, $allowed_protocols ) {
     1689        $content    = wp_kses_no_null( $content );
    16901690        $iterations = 0;
    16911691
    16921692        do {
    1693                 $original_string = $string;
    1694                 $string          = wp_kses_bad_protocol_once( $string, $allowed_protocols );
    1695         } while ( $original_string != $string && ++$iterations < 6 );
    1696 
    1697         if ( $original_string != $string ) {
     1693                $original_content = $content;
     1694                $content          = wp_kses_bad_protocol_once( $content, $allowed_protocols );
     1695        } while ( $original_content != $content && ++$iterations < 6 );
     1696
     1697        if ( $original_content != $content ) {
    16981698                return '';
    16991699        }
    17001700
    1701         return $string;
     1701        return $content;
    17021702}
    17031703
    … …  
    17091709 * @since 1.0.0
    17101710 *
    1711  * @param string $string Content to filter null characters from.
     1711 * @param string $content Content to filter null characters from.
    17121712 * @param array  $options Set 'slash_zero' => 'keep' when '\0' is allowed. Default is 'remove'.
    17131713 * @return string Filtered content.
    17141714 */
    1715 function wp_kses_no_null( $string, $options = null ) {
     1715function wp_kses_no_null( $content, $options = null ) {
    17161716        if ( ! isset( $options['slash_zero'] ) ) {
    17171717                $options = array( 'slash_zero' => 'remove' );
    17181718        }
    17191719
    1720         $string = preg_replace( '/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $string );
     1720        $content = preg_replace( '/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $content );
    17211721        if ( 'remove' === $options['slash_zero'] ) {
    1722                 $string = preg_replace( '/\\\\+0+/', '', $string );
    1723         }
    1724 
    1725         return $string;
     1722                $content = preg_replace( '/\\\\+0+/', '', $content );
     1723        }
     1724
     1725        return $content;
    17261726}
    17271727
    … …  
    17341734 * @since 1.0.0
    17351735 *
    1736  * @param string $string String to strip slashes from.
     1736 * @param string $content String to strip slashes from.
    17371737 * @return string Fixed string with quoted slashes.
    17381738 */
    1739 function wp_kses_stripslashes( $string ) {
    1740         return preg_replace( '%\\\\"%', '"', $string );
     1739function wp_kses_stripslashes( $content ) {
     1740        return preg_replace( '%\\\\"%', '"', $content );
    17411741}
    17421742
    … …  
    17731773 * @since 1.0.0
    17741774 *
    1775  * @param string $string
     1775 * @param string $attr
    17761776 * @return string
    17771777 */
    1778 function wp_kses_html_error( $string ) {
    1779         return preg_replace( '/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $string );
     1778function wp_kses_html_error( $attr ) {
     1779        return preg_replace( '/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $attr );
    17801780}
    17811781
    … …  
    17881788 * @since 1.0.0
    17891789 *
    1790  * @param string   $string            Content to check for bad protocols.
     1790 * @param string   $content           Content to check for bad protocols.
    17911791 * @param string[] $allowed_protocols Array of allowed URL protocols.
    17921792 * @param int      $count             Depth of call recursion to this function.
    17931793 * @return string Sanitized content.
    17941794 */
    1795 function wp_kses_bad_protocol_once( $string, $allowed_protocols, $count = 1 ) {
    1796         $string  = preg_replace( '/(&#0*58(?![;0-9])|&#x0*3a(?![;a-f0-9]))/i', '$1;', $string );
    1797         $string2 = preg_split( '/:|&#0*58;|&#x0*3a;|&colon;/i', $string, 2 );
    1798         if ( isset( $string2[1] ) && ! preg_match( '%/\?%', $string2[0] ) ) {
    1799                 $string   = trim( $string2[1] );
    1800                 $protocol = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols );
     1795function wp_kses_bad_protocol_once( $content, $allowed_protocols, $count = 1 ) {
     1796        $content  = preg_replace( '/(&#0*58(?![;0-9])|&#x0*3a(?![;a-f0-9]))/i', '$1;', $content );
     1797        $content2 = preg_split( '/:|&#0*58;|&#x0*3a;|&colon;/i', $content, 2 );
     1798
     1799        if ( isset( $content2[1] ) && ! preg_match( '%/\?%', $content2[0] ) ) {
     1800                $content  = trim( $content2[1] );
     1801                $protocol = wp_kses_bad_protocol_once2( $content2[0], $allowed_protocols );
    18011802                if ( 'feed:' === $protocol ) {
    18021803                        if ( $count > 2 ) {
    18031804                                return '';
    18041805                        }
    1805                         $string = wp_kses_bad_protocol_once( $string, $allowed_protocols, ++$count );
    1806                         if ( empty( $string ) ) {
    1807                                 return $string;
     1806                        $content = wp_kses_bad_protocol_once( $content, $allowed_protocols, ++$count );
     1807                        if ( empty( $content ) ) {
     1808                                return $content;
    18081809                        }
    18091810                }
    1810                 $string = $protocol . $string;
    1811         }
    1812 
    1813         return $string;
     1811                $content = $protocol . $content;
     1812        }
     1813
     1814        return $content;
    18141815}
    18151816
    … …  
    18251826 * @since 1.0.0
    18261827 *
    1827  * @param string   $string            URI scheme to check against the list of allowed protocols.
     1828 * @param string   $scheme            URI scheme to check against the list of allowed protocols.
    18281829 * @param string[] $allowed_protocols Array of allowed URL protocols.
    18291830 * @return string Sanitized content.
    18301831 */
    1831 function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) {
    1832         $string2 = wp_kses_decode_entities( $string );
    1833         $string2 = preg_replace( '/\s/', '', $string2 );
    1834         $string2 = wp_kses_no_null( $string2 );
    1835         $string2 = strtolower( $string2 );
     1832function wp_kses_bad_protocol_once2( $scheme, $allowed_protocols ) {
     1833        $scheme = wp_kses_decode_entities( $scheme );
     1834        $scheme = preg_replace( '/\s/', '', $scheme );
     1835        $scheme = wp_kses_no_null( $scheme );
     1836        $scheme = strtolower( $scheme );
    18361837
    18371838        $allowed = false;
    18381839        foreach ( (array) $allowed_protocols as $one_protocol ) {
    1839                 if ( strtolower( $one_protocol ) == $string2 ) {
     1840                if ( strtolower( $one_protocol ) == $scheme ) {
    18401841                        $allowed = true;
    18411842                        break;
    … …  
    18441845
    18451846        if ( $allowed ) {
    1846                 return "$string2:";
     1847                return "$scheme:";
    18471848        } else {
    18481849                return '';
    … …  
    18621863 * @since 5.5.0 Added `$context` parameter.
    18631864 *
    1864  * @param string $string Content to normalize entities.
     1865 * @param string $content Content to normalize entities.
    18651866 * @param string $context Context for normalization. Can be either 'html' or 'xml'.
    18661867 *                        Default 'html'.
    18671868 * @return string Content with normalized entities.
    18681869 */
    1869 function wp_kses_normalize_entities( $string, $context = 'html' ) {
     1870function wp_kses_normalize_entities( $content, $context = 'html' ) {
    18701871        // Disarm all entities by converting & to &amp;
    1871         $string = str_replace( '&', '&amp;', $string );
     1872        $content = str_replace( '&', '&amp;', $content );
    18721873
    18731874        // Change back the allowed entities in our list of allowed entities.
    18741875        if ( 'xml' === $context ) {
    1875                 $string = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_xml_named_entities', $string );
     1876                $content = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_xml_named_entities', $content );
    18761877        } else {
    1877                 $string = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string );
    1878         }
    1879         $string = preg_replace_callback( '/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string );
    1880         $string = preg_replace_callback( '/&amp;#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string );
    1881 
    1882         return $string;
     1878                $content = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $content );
     1879        }
     1880        $content = preg_replace_callback( '/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $content );
     1881        $content = preg_replace_callback( '/&amp;#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $content );
     1882
     1883        return $content;
    18831884}
    18841885
    … …  
    20152016 * @since 1.0.0
    20162017 *
    2017  * @param string $string Content to change entities.
     2018 * @param string $content Content to change entities.
    20182019 * @return string Content after decoded entities.
    20192020 */
    2020 function wp_kses_decode_entities( $string ) {
    2021         $string = preg_replace_callback( '/&#([0-9]+);/', '_wp_kses_decode_entities_chr', $string );
    2022         $string = preg_replace_callback( '/&#[Xx]([0-9A-Fa-f]+);/', '_wp_kses_decode_entities_chr_hexdec', $string );
    2023 
    2024         return $string;
     2021function wp_kses_decode_entities( $content ) {
     2022        $content = preg_replace_callback( '/&#([0-9]+);/', '_wp_kses_decode_entities_chr', $content );
     2023        $content = preg_replace_callback( '/&#[Xx]([0-9A-Fa-f]+);/', '_wp_kses_decode_entities_chr_hexdec', $content );
     2024
     2025        return $content;
    20252026}
    20262027
    … …  
    20322033 * @ignore
    20332034 *
    2034  * @param array $match preg match
     2035 * @param array $matches preg match
    20352036 * @return string
    20362037 */
    2037 function _wp_kses_decode_entities_chr( $match ) {
    2038         return chr( $match[1] );
     2038function _wp_kses_decode_entities_chr( $matches ) {
     2039        return chr( $matches[1] );
    20392040}
    20402041
    … …  
    20462047 * @ignore
    20472048 *
    2048  * @param array $match preg match
     2049 * @param array $matches preg match
    20492050 * @return string
    20502051 */
    2051 function _wp_kses_decode_entities_chr_hexdec( $match ) {
    2052         return chr( hexdec( $match[1] ) );
     2052function _wp_kses_decode_entities_chr_hexdec( $matches ) {
     2053        return chr( hexdec( $matches[1] ) );
    20532054}
    20542055
Note: See TracChangeset for help on using the changeset viewer.