Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-12-23 01:27:36 +01:00
Code Issues Projects Releases Wiki Activity

KSES: Use the polyfilled PHP 8 string functions in _wp_kses_allow_pdf_objects():

Browse Source 
* `str_contains()`
* `str_ends_with()`
* `str_starts_with()`

Additionally, include a test for a PDF file in an `<object>` tag with an unsupported protocol.

Follow-up to [51963], [52039], [52040], [52304], [52309].

Props TobiasBg, ramonopoly.
See #54261.
Built from https://develop.svn.wordpress.org/trunk@52326


git-svn-id: http://core.svn.wordpress.org/trunk@51918 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2021-12-06 11:08:01 +00:00
parent a9edd7ba88
commit 18d741be37
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
wp-includes/kses.php
View File

@ -2593,12 +2593,12 @@ function _wp_add_global_attributes( $value ) {
*/ */
function _wp_kses_allow_pdf_objects( $url ) { function _wp_kses_allow_pdf_objects( $url ) {
// We're not interested in URLs that contain query strings or fragments. // We're not interested in URLs that contain query strings or fragments.
if ( strpos( $url, '?' ) !== false || strpos( $url, '#' ) !== false ) { if ( str_contains( $url, '?' ) || str_contains( $url, '#' ) ) {
return false; return false;
} }
// If it doesn't have a PDF extension, it's not safe. // If it doesn't have a PDF extension, it's not safe.
if ( 0 !== substr_compare( $url, '.pdf', -4, 4, true ) ) { if ( ! str_ends_with( $url, '.pdf' ) ) {
return false; return false;
} }
@ -2607,7 +2607,10 @@ function _wp_kses_allow_pdf_objects( $url ) {
$parsed_url = wp_parse_url( $upload_info['url'] ); $parsed_url = wp_parse_url( $upload_info['url'] );
$upload_host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : ''; $upload_host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
$upload_port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : ''; $upload_port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
if ( 0 === strpos( $url, "http://$upload_host$upload_port/" ) || 0 === strpos( $url, "https://$upload_host$upload_port/" ) ) {
if ( str_starts_with( $url, "http://$upload_host$upload_port/" )
|| str_starts_with( $url, "https://$upload_host$upload_port/" )
) {
return true; return true;
} }

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '5.9-beta1-52325'; $wp_version = '5.9-beta1-52326';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.