Changeset 61499

Timestamp:

01/19/2026 08:44:38 PM (3 months ago)

Author:

dmsnell

Message:

HTML API: Fix missing null-check in wp_kses_hair() refactor.

When no attributes are present, wp_kses_hair() should return an empty
array, but when the refactor was merged, the code assumed there would be
attributes.

An alternative fix is to use null-coalescing to iterate over an empty
array. This would produce a marginally smaller function and read
slightly more cleanly, but there’s no need to enter the foreach loop
when it’s known in advance that there’s nothing over which to iterate.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/10758
Discussed in: https://core.trac.wordpress.org/ticket/63724

Follow-up to [61467].

Props: dd32, dmsnell, jonsurrell.
See: #63724.

Location:

trunk

Files:

• src/wp-includes/kses.php (modified) (2 diffs)
• tests/phpunit/tests/kses/wpKsesHair.php (modified) (1 diff)

trunk/src/wp-includes/kses.php

@@ -1624 +1624 @@
     $processor->next_token();
 
+    $attribute_names = $processor->get_attribute_names_with_prefix( '' );
+    if ( ! isset( $attribute_names ) ) {
+        return $attributes;
+    }
+
     $syntax_characters = array(
         '&' => '&',
@@ -1632 +1637 @@
     );
 
-    foreach ( $processor->get_attribute_names_with_prefix( '' ) as $name ) {
+    foreach ( $attribute_names as $name ) {
         $value   = $processor->get_attribute( $name );
         $is_bool = true === $value;

trunk/tests/phpunit/tests/kses/wpKsesHair.php

@@ -40 +40 @@
      */
     public function data_attribute_parsing() {
+        yield 'empty attributes' => array(
+            '',
+            array(),
+        );
+
+        yield 'prematurely-terminated attributes' => array(
+            '>',
+            array(),
+        );
+
+        yield 'prematurely-terminated malformed attributes' => array(
+            'foo>bar="baz"',
+            array(
+                'foo' => array(
+                    'name'  => 'foo',
+                    'value' => '',
+                    'whole' => 'foo',
+                    'vless' => 'y',
+                ),
+            ),
+        );
+
         yield 'single attribute with double quotes' => array(
             'class="test-class"',