Changeset 63063

Timestamp:

08/06/2026 03:33:27 PM (2 months ago)

Author:

johnbillion

Message:

Formatting: Prevent stack overflow in safecss_filter_attr.

Props xknown, vortfu, westonruter, dmsnell, jorbin.

File:

• trunk/src/wp-includes/kses.php (modified) (1 diff)

trunk/src/wp-includes/kses.php

@@ -3010 +3010 @@
                         );
 
+                        // Bail if the recursive function stripping hit a PCRE error (e.g. stack/backtrack limit).
+                        if ( null === $css_test_string ) {
+                                continue;
+                        }
+
                         /*
                          * Disallow CSS containing \ ( & } = or comments, except for within url(), var(), calc(), etc.
                          * which were removed from the test string above.
                          */
-                        $allow_css = ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string );
+                        $allow_css = 0 === preg_match( '%[\\\(&=}]|/\*%', $css_test_string );
 
                         /**