Comment blacklist can be bypassed with HTML

[cfinke]

If the comment blacklist contains the entry "bannedword", users can still post comments containing (or appearing to contain) "bannedword" by using HTML:

<b>banned</b>word
banned<b></b>word
banned<b>word</b>

A solution: wp_blacklist_check() could run wp_kses() before looking for blacklist entries. Patch attached.

[rachelbaker]

Added unit test

[rachelbaker]

In 37208.2.diff​ I added some basic unit tests for wp_blacklist_check including test_should_return_true_when_content_with_html_matches_blacklist_keys

[rachelbaker]

In 38047:

Comments: Strip html tags from comment content before blacklist_keys comparison.

Use wp_kses() to clean comment_content for preg_match against the blacklist_keys. Also includes some initial unit tests for wp_blacklist_check().
Previously, if a blacklisted key was used in comment_content split by an html tag the regex in wp_blacklist_check() would not find a match. Example: Where "springfield" was a blacklisted word, if the content of a comment included spring<i>field</i>" wp_blacklist_check()` would not return true.

Props cfinke.
Fixes #37208.

[rachelbaker]

In 38048:

Comments: Include comment_content with html and without in blacklist_keys comparison.

After [38047], also include the comment_content with html in the preg_match against blacklist keys to match urls.

Props ocean90.
Fixes #37208.

[dd32]

@rachelbaker @cfinke Should this just use wp_strip_all_tags() instead of wp_kses()? KSes is designed to limit to a whitelist, if you want no tags, might as well just strip them entirely.

[cfinke]

Replying to dd32:

@rachelbaker @cfinke Should this just use wp_strip_all_tags() instead of wp_kses()? KSes is designed to limit to a whitelist, if you want no tags, might as well just strip them entirely.

I wasn't aware of wp_strip_all_tags(), but it does seem more appropriate.

[rachelbaker]

@dd32 Thanks for catching this. Added 37208_strip_tags.diff​ patch that uses wp_strip_all_tags()

[peterwilsoncc]

37208_strip_tags.diff​ looks good, passes unit tests, works.

[ocean90]

In 38092:

Comments: Use wp_strip_all_tags() to strip HTML tags.

wp_kses() should only be used if you have a whitelist.

Props rachelbaker.
Fixes #37208.