Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Formatting: Extend `wp_kses_hair` and `wp_kses_hair_parse` to allow digits and underscores. 

Fixes a lot of issues around parsing XML/HTML attributes.

Fixes #49464.

See #34406, #48608.

Props codeforest, zodiac1978, johnpgreen, dlh, ayeshrajans, johnpgreen, rilwis, travisnorthcutt, miqrogroove, chriscct7, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@48132


git-svn-id: http://core.svn.wordpress.org/trunk@47901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
whyisjake 2020-06-23 05:07:11 +00:00
parent 98fc60aabe
commit 446d06c45d
2 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
wp-includes/kses.php
View File

@ -1261,11 +1261,11 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
switch ( $mode ) {
case 0:
if ( preg_match( '/^([-a-zA-Z:]+)/', $attr, $match ) ) {
if ( preg_match( '/^([_a-zA-Z][-_a-zA-Z0-9:.]*)/', $attr, $match ) ) {
$attrname = $match[1];
$working = 1;
$mode = 1;
$attr = preg_replace( '/^[-a-zA-Z:]+/', '', $attr );
$attr = preg_replace( '/^[_a-zA-Z][-_a-zA-Z0-9:.]*/', '', $attr );
}
break;
@ -1451,25 +1451,25 @@ function wp_kses_hair_parse( $attr ) {
// phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- don't remove regex indentation
$regex =
'(?:'
. '[-a-zA-Z:]+' // Attribute name.
. '|'
. '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
. ')'
. '(?:' // Attribute value.
. '\s*=\s*' // All values begin with '='.
. '(?:'
. '"[^"]*"' // Double-quoted.
. '|'
. "'[^']*'" // Single-quoted.
. '|'
. '[^\s"\']+' // Non-quoted.
. '(?:\s|$)' // Must have a space.
. ')'
. '|'
. '(?:\s|$)' // If attribute has no value, space is required.
. ')'
. '\s*'; // Trailing space is optional except as mentioned above.
'(?:'
. '[_a-zA-Z][-_a-zA-Z0-9:.]*' // Attribute name.
. '|'
. '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
. ')'
. '(?:' // Attribute value.
. '\s*=\s*' // All values begin with '='.
. '(?:'
. '"[^"]*"' // Double-quoted.
. '|'
. "'[^']*'" // Single-quoted.
. '|'
. '[^\s"\']+' // Non-quoted.
. '(?:\s|$)' // Must have a space.
. ')'
. '|'
. '(?:\s|$)' // If attribute has no value, space is required.
. ')'
. '\s*'; // Trailing space is optional except as mentioned above.
// phpcs:enable
// Although it is possible to reduce this procedure to a single regexp,

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.5-alpha-48131';
$wp_version = '5.5-alpha-48132';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.