Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-12-23 01:27:36 +01:00
Code Issues Projects Releases Wiki Activity

Formatting: Extend wp_kses_hair and wp_kses_hair_parse to allow digits and underscores.

Browse Source 
Fixes a lot of issues around parsing XML/HTML attributes.

Fixes #49464.

See #34406, #48608.

Props codeforest, zodiac1978, johnpgreen, dlh, ayeshrajans, johnpgreen, rilwis, travisnorthcutt, miqrogroove, chriscct7, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@48132


git-svn-id: http://core.svn.wordpress.org/trunk@47901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
whyisjake 2020-06-23 05:07:11 +00:00
parent 98fc60aabe
commit 446d06c45d
2 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
wp-includes/kses.php
View File

@ -1261,11 +1261,11 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
switch ( $mode ) { switch ( $mode ) {
case 0: case 0:
if ( preg_match( '/^([-a-zA-Z:]+)/', $attr, $match ) ) { if ( preg_match( '/^([_a-zA-Z][-_a-zA-Z0-9:.]*)/', $attr, $match ) ) {
$attrname = $match[1]; $attrname = $match[1];
$working = 1; $working = 1;
$mode = 1; $mode = 1;
$attr = preg_replace( '/^[-a-zA-Z:]+/', '', $attr ); $attr = preg_replace( '/^[_a-zA-Z][-_a-zA-Z0-9:.]*/', '', $attr );
} }
break; break;
@ -1451,25 +1451,25 @@ function wp_kses_hair_parse( $attr ) {
// phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- don't remove regex indentation // phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- don't remove regex indentation
$regex = $regex =
'(?:' '(?:'
. '[-a-zA-Z:]+' // Attribute name. . '[_a-zA-Z][-_a-zA-Z0-9:.]*' // Attribute name.
. '|' . '|'
. '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html. . '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
. ')' . ')'
. '(?:' // Attribute value. . '(?:' // Attribute value.
. '\s*=\s*' // All values begin with '='. . '\s*=\s*' // All values begin with '='.
. '(?:' . '(?:'
. '"[^"]*"' // Double-quoted. . '"[^"]*"' // Double-quoted.
. '|' . '|'
. "'[^']*'" // Single-quoted. . "'[^']*'" // Single-quoted.
. '|' . '|'
. '[^\s"\']+' // Non-quoted. . '[^\s"\']+' // Non-quoted.
. '(?:\s|$)' // Must have a space. . '(?:\s|$)' // Must have a space.
. ')' . ')'
. '|' . '|'
. '(?:\s|$)' // If attribute has no value, space is required. . '(?:\s|$)' // If attribute has no value, space is required.
. ')' . ')'
. '\s*'; // Trailing space is optional except as mentioned above. . '\s*'; // Trailing space is optional except as mentioned above.
// phpcs:enable // phpcs:enable
// Although it is possible to reduce this procedure to a single regexp, // Although it is possible to reduce this procedure to a single regexp,

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '5.5-alpha-48131'; $wp_version = '5.5-alpha-48132';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.