Changeset 62003 for branches/5.0/src/wp-includes/kses.php

Timestamp:

03/13/2026 12:41:24 PM (5 months ago)

Author:

johnbillion

Message:

Grouped backports for the 5.0 branch.

• XML-RPC: Switch to wp_safe_remote() when fetching a pingback URL.
• HTML API: Prevent WP_HTML_Tag_Processor instances being unserialized and add some extra logic for validating pattern and template file paths.
• KSES: Optimize PCRE pattern detecting numeric character references.
• Customize: Improve escaping approach used for nav menu attributes.
• Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager.
• Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag.
• Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library.

Merges [61879-61884,61886-61887,61890,61913] to the 5.0 branch.

Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, aurdasjb.

Location:

branches/5.0

Files:

• . (modified) (1 prop)
• src/wp-includes/kses.php (modified) (6 diffs)

branches/5.0/src/wp-includes/kses.php

@@ -544 +544 @@
         $allowed_protocols = wp_allowed_protocols();
         $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
-        
+
         // Preserve leading and trailing whitespace.
         $matches = array();
@@ -556 +556 @@
                 $string = substr( $string, strlen( $lead ), -strlen( $trail ) );
         }
-        
+
         // Parse attribute name and value from input.
         $split = preg_split( '/\s*=\s*/', $string, 2 );
@@ -593 +593 @@
                 $vless = 'y';
         }
-        
+
         // Sanitize attribute by name.
         wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html );
@@ -1148 +1148 @@
                 $xhtml_slash = '';
         }
-        
+
         // Split it
         $attrarr = wp_kses_hair_parse( $attr );
@@ -1158 +1158 @@
         array_unshift( $attrarr, $begin . $slash . $elname );
         array_push( $attrarr, $xhtml_slash . $end );
-        
+
         return $attrarr;
 }
@@ -1473 +1473 @@
         $string = str_replace('&', '&', $string);
 
-        // Change back the allowed entities in our entity whitelist
-        $string = preg_replace_callback('/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string);
-        $string = preg_replace_callback('/&#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string);
-        $string = preg_replace_callback('/&#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string);
+        $string = preg_replace_callback( '/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string );
+        $string = preg_replace_callback( '/&#(0*+[1-9][0-9]{0,6});/', 'wp_kses_normalize_entities2', $string );
+        $string = preg_replace_callback( '/&#[Xx](0*+[1-9A-Fa-f][0-9A-Fa-f]{0,5});/', 'wp_kses_normalize_entities3', $string );
 
         return $string;