WordPress.org
Get WordPress

Make WordPress Core

Opened 15 years ago

Closed 12 years ago

#17847 closed defect (bug) (fixed)

wp_kses_hair is too stringent

Reported by: jorbin Owned by: nacin
Priority: normal Milestone: 3.9
Component: Formatting Version: 1.5
Severity: normal Keywords: has-patch
Cc: Focuses:

Description

attributes from custom xml name spaces may use colons, but the regex used inside wp_kses_hair doesn't allow them through.

Attachments (1)

18320.diff​ (577 bytes ) - added by jorbin 15 years ago.

Download all attachments as: .zip

Change History (7)

@jorbin
15 years ago

#1 @nacin
15 years ago

  • Component Security → Formatting

Can you provide some test cases as to what these attributes look like?

#2 @jorbin
15 years ago

addthis:url is one example

#3 @johnbillion
15 years ago

Google Products is one too, using g:* for many attributes in their product data feeds.

#4 @kurtpayne
15 years ago

  • Version → 1.5

#5 @nacin
13 years ago

  • Milestone Awaiting Review → 3.9

Appears safe to me. Will want to get some eyes on this before proceeding.

#6 @nacin
12 years ago

  • Owner set to nacin
  • Resolution → fixed
  • Status new → closed

In 27707:

Allow XML attributes with colons to be read by kses.

The attribute would still need to be whitelisted to get through the filters.

props jorbin.
fixes #17847.

Note: See TracTickets for help on using tickets.