Parse blocks being applied unnecessarily

[spacedmonkey]

The filter wp_pre_kses_block_attributes is applied to any field that runs through wp_kses_hook. Any fields on any object field that is run through wp_filter_kses. This includes fields like comment_author_email, user_email, term_name and user_last_name. It is extremely unlikely that these text fields will contain block data. This filter should be changed.

[joemcgill]

This was added in [46896], which seems to have been done for security purposes, so whomever looks into this should ensure that any adjustments made here don't expose the security bug that this was added to fix.

[spacedmonkey]

I wonder if @aduth or @whyisjake can add some context here.

[aduth]

Yes, the referenced patch was related to a security vulnerability, so I’d exercise caution with any revisions. That said, there were additional tests in the private security test suite beyond what’s included in the public commit, which may provide some assurances to avoid a regression.

As far as fields where block content isn’t expected or supported, I don’t specifically recall if those were susceptible in the same way, so it might be possible to exclude them specifically for some gains.

There may also be some options to optimize such that it’s only applied at save-time, but it’d need to be done in a way that handles legacy content.

I’d suggest collaborating with someone on the security team to navigate any potential regressions, as well as to help run the security test suite against any proposed patches.

Trac ticket: https://core.trac.wordpress.org/ticket/59310

[spacedmonkey]

I have put together a PR as a POC of remove filter on term name. This reduced the number of times blocks are parsed. See ​https://github.com/WordPress/wordpress-develop/pull/5174

[spacedmonkey]

I am unable to work on this ATM. I wonder if @joemcgill or @flixos90 has time to look into this.

[dmsnell]

This should be resolved by the refactor of wp_kses() in #66208. That refactor replaces the legacy wp_kses() implementation with one based on the HTML API, which is able to bypass the pre_kses filter for block parsing, and with the help of WP_Block_Processor, only parse block comment delimiters in place and skips the filter entirely when no JSON attributes are present.

This avoids the parse/print cycle, avoids the pre-pass through the HTML content, and avoids loading a fully-parsed block tree in memory.

[dmsnell]

#61455 was marked as a duplicate.

[dmsnell]

In 64233:

KSES: Reimplement with Tag Processor.

This patch introduces a new version of wp_kses(), temporarily living alongside the legacy implementation in a new function named wp_sanitize_html_kses(). This new implementation is based on the HTML API, which provides more reliable parsing of HTML inputs.

• A new filter, wp_kses_force_legacy_parser, offers an opt-out for the new code, and for testing side-by-side.
• Many tests have been updated because of hard-coded values which result from historic HTML parsing oddities. They have been updated to reflect the newer parsing, the spec-compliant parsing.

There should be no changes necessary to calling function with this change.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13271
Discussed in: https://core.trac.wordpress.org/ticket/66208

Props barry, dmsnell, johnbillion, jonsurrell, jorbin, rfaile313, westonruter.
Fixes #37698, #58921, #59310, #63208.