sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Formatting: Extend wp_kses_hair and wp_kses_hair_parse to allow digits and underscores.

Browse Source 
Fixes a lot of issues around parsing XML/HTML attributes.

Fixes #49464.

See #34406, #48608.

Props codeforest, zodiac1978, johnpgreen, dlh, ayeshrajans, johnpgreen, rilwis, travisnorthcutt, miqrogroove, chriscct7, whyisjake.


git-svn-id: https://develop.svn.wordpress.org/trunk@48132 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jake Spurlock 2020-06-23 05:05:57 +00:00
parent 8b483b77b9
commit 888421a924
2 changed files with 41 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
src/wp-includes/kses.php
View File

@ -1261,11 +1261,11 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
switch ( $mode ) { switch ( $mode ) {
case 0: case 0:
if ( preg_match( '/^([-a-zA-Z:]+)/', $attr, $match ) ) { if ( preg_match( '/^([_a-zA-Z][-_a-zA-Z0-9:.]*)/', $attr, $match ) ) {
$attrname = $match[1]; $attrname = $match[1];
$working = 1; $working = 1;
$mode = 1; $mode = 1;
$attr = preg_replace( '/^[-a-zA-Z:]+/', '', $attr ); $attr = preg_replace( '/^[_a-zA-Z][-_a-zA-Z0-9:.]*/', '', $attr );
} }
break; break;
@ -1451,25 +1451,25 @@ function wp_kses_hair_parse( $attr ) {
// phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- don't remove regex indentation // phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- don't remove regex indentation
$regex = $regex =
'(?:' '(?:'
. '[-a-zA-Z:]+' // Attribute name. . '[_a-zA-Z][-_a-zA-Z0-9:.]*' // Attribute name.
. '|' . '|'
. '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html. . '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
. ')' . ')'
. '(?:' // Attribute value. . '(?:' // Attribute value.
. '\s*=\s*' // All values begin with '='. . '\s*=\s*' // All values begin with '='.
. '(?:' . '(?:'
. '"[^"]*"' // Double-quoted. . '"[^"]*"' // Double-quoted.
. '|' . '|'
. "'[^']*'" // Single-quoted. . "'[^']*'" // Single-quoted.
. '|' . '|'
. '[^\s"\']+' // Non-quoted. . '[^\s"\']+' // Non-quoted.
. '(?:\s|$)' // Must have a space. . '(?:\s|$)' // Must have a space.
. ')' . ')'
. '|' . '|'
. '(?:\s|$)' // If attribute has no value, space is required. . '(?:\s|$)' // If attribute has no value, space is required.
. ')' . ')'
. '\s*'; // Trailing space is optional except as mentioned above. . '\s*'; // Trailing space is optional except as mentioned above.
// phpcs:enable // phpcs:enable
// Although it is possible to reduce this procedure to a single regexp, // Although it is possible to reduce this procedure to a single regexp,

20
tests/phpunit/tests/kses.php
View File

@ -629,6 +629,26 @@ EOF;
"array[1]='z'z'z'z", "array[1]='z'z'z'z",
false, false,
), ),
// using digit in attribute name should work
array(
'href="https://example.com/[shortcode attr=\'value\']" data-op3-timer-seconds="0"',
array( 'href="https://example.com/[shortcode attr=\'value\']" ', 'data-op3-timer-seconds="0"' ),
),
// using underscore in attribute name should work
array(
'href="https://example.com/[shortcode attr=\'value\']" data-op_timer-seconds="0"',
array( 'href="https://example.com/[shortcode attr=\'value\']" ', 'data-op_timer-seconds="0"' ),
),
// using period in attribute name should work
array(
'href="https://example.com/[shortcode attr=\'value\']" data-op.timer-seconds="0"',
array( 'href="https://example.com/[shortcode attr=\'value\']" ', 'data-op.timer-seconds="0"' ),
),
// using digit at a beginning of attribute name should return false
array(
'href="https://example.com/[shortcode attr=\'value\']" 3data-op-timer-seconds="0"',
false,
),
); );
} }