Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

KSES: Deprecate `wp_kses_js_entities()`. 

This function was originally introduced to fix an XSS attack in Netscape 4, which never affected any other browsers, or later versions of Netscape.

I'm willing to go out on a limb, and say that we've officially dropped security support for Netscape 4.

Props dmsnell, desrosj.
Fixes #33848.


Built from https://develop.svn.wordpress.org/trunk@38785


git-svn-id: http://core.svn.wordpress.org/trunk@38728 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Gary Pendergast 2016-10-13 22:25:31 +00:00
parent acd764a1d3
commit 456f8015b7
3 changed files with 27 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
wp-includes/deprecated.php
View File

@ -3772,3 +3772,29 @@ function get_paged_template() {
return get_query_template( 'paged' );
}
/**
* Removes the HTML JavaScript entities found in early versions of Netscape 4.
*
* Previously, this function was pulled in from the original
* import of kses and removed a specific vulnerability only
* existent in early version of Netscape 4. However, this
* vulnerability never affected any other browsers and can
* be considered safe for the modern web.
*
* The regular expression which sanitized this vulnerability
* has been removed in consideration of the performance and
* energy demands it placed, now merely passing through its
* input to the return.
*
* @since 1.0.0
* @deprecated deprecated since 4.7
*
* @param string $string
* @return string
*/
function wp_kses_js_entities( $string ) {
_deprecated_function( __FUNCTION__, '4.7.0' );
return preg_replace( '%&\s*\{[^}]*(\}\s*;?|$)%', '', $string );
}

14
wp-includes/kses.php
View File

@ -527,7 +527,6 @@ function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
if ( empty( $allowed_protocols ) )
$allowed_protocols = wp_allowed_protocols();
$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
$string = wp_kses_js_entities($string);
$string = wp_kses_normalize_entities($string);
$string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook
return wp_kses_split($string, $allowed_html, $allowed_protocols);
@ -550,7 +549,6 @@ function wp_kses_one_attr( $string, $element ) {
$allowed_html = wp_kses_allowed_html( 'post' );
$allowed_protocols = wp_allowed_protocols();
$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
$string = wp_kses_js_entities( $string );
// Preserve leading and trailing whitespace.
$matches = array();
@ -1295,18 +1293,6 @@ function wp_kses_array_lc($inarray) {
return $outarray;
}
/**
* Removes the HTML JavaScript entities found in early versions of Netscape 4.
*
* @since 1.0.0
*
* @param string $string
* @return string
*/
function wp_kses_js_entities($string) {
return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string);
}
/**
* Handles parsing errors in wp_kses_hair().
*

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '4.7-alpha-38784';
$wp_version = '4.7-alpha-38785';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.