kses removes last attribute in empty xhtml elements

[whoismanu]

wp_filter_post_kses removes the last attribute from an empty xhtml tag (even if it is an allowed one) if there is no whitespace between the last attribute and the closing />. Now, according to my understanding of the xhtml specification there
​doesn't have to be a whitespace.

Here's an example with an img tag (especially annoying because it kills the src attribute and you are left with no clue as to why your image doesn't show up):

$texttest = '<img width="700" height="525" alt="Wrecked I" src="http://www.whoismanu.com/wp-content/2007_08/img_2659_web.jpg"/>';
wp_filter_post_kses($texttest);

And here's what goes into kses and what comes out:

data in: <img width="700" height="525" alt="Wrecked I" src="http://www.whoismanu.com/wp-content/2007_08/img_2659_web.jpg"/>

data out: <img width="700" height="525" alt="Wrecked I">

Here's an example where there is whitespace, kses handles it correctly:

$texttest = '<img width="700" height="525" alt="Wrecked I" src="http://www.whoismanu.com/wp-content/2007_08/img_2659_web.jpg" />';
wp_filter_post_kses($texttest);

Here's the result:

data in: <img width="700" height="525" alt="Wrecked I" src="http://www.whoismanu.com/wp-content/2007_08/img_2659_web.jpg" />

data out: <img width="700" height="525" alt="Wrecked I" src="http://www.whoismanu.com/wp-content/2007_08/img_2659_web.jpg" />

[JeremyVisser]

Confirmed on latest trunk (r5859).

[xknown]

patch against trunk

[Denis-de-Bernardy]

still current?

[hakre]

confirmed, this is still current. Even more worse, that function now addslashes:

in: string '<img width="700" height="525" alt="Wrecked I" src="http://www.whoismanu.com/wp-content/2007_08/img_2659_web.jpg"/>' (length=114)

out: string '<img width=\"700\" height=\"525\" alt=\"Wrecked I\">' (length=52)

looks like the faulty stripslashes mis-concept in wordpress breaks necks again.

• [2902] ryan 2005.09.21 18:35:35 stripslashes before running kses. Props donncha. fixes #1697

[markjaquith]

Flagging this for a look in early 3.0

[nacin]

#12394