Opened 5 years ago
Last modified 5 years ago
#54138 new defect (bug)
wp_strip_all_tags should remove scripts/styles content recursively
| Reported by: | wppunk | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | Formatting | Version: | |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: |
Description
If we try to run the next code <scri<script></script>pt>alert("krya");</script> via the wp_strip_all_tags function it remove the script content only once. So, the next hack allows passing the script content throw the function.
## In details.
First iteration:
- input: `<scri<script></script>pt>alert("krya");</script>
- output:
<script>alert("krya");</script>
Thankfully the strip_tags removes scripts tags later, but the content is still present.
Change History (2)
Note:
See TracTickets
for help on using tickets.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
Remove scripts and styles tags recursively.
Trac ticket: https://core.trac.wordpress.org/ticket/54138#ticket