From b202cb423a7208002498d66749f680e6e931ba84 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov@git.wordpress.org>
Date: Sat, 14 Dec 2019 15:51:33 +0000
Subject: [PATCH] Formatting: Return early from `wp_kses_attr_check()` if the
 element is not in the list of allowed elements and attributes.

Props krynes, tristanleboss.
Fixes #48549.

git-svn-id: https://develop.svn.wordpress.org/trunk@46959 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/kses.php | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/kses.php b/src/wp-includes/kses.php
index bc8db94995..179aaebd5b 100644
--- a/src/wp-includes/kses.php
+++ b/src/wp-includes/kses.php
@@ -1152,9 +1152,18 @@ function wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) {
  * @return bool Whether or not the attribute is allowed.
  */
 function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
-	$allowed_attr = $allowed_html[ strtolower( $element ) ];
+	$name_low    = strtolower( $name );
+	$element_low = strtolower( $element );
+
+	if ( ! isset( $allowed_html[ $element_low ] ) ) {
+		$name  = '';
+		$value = '';
+		$whole = '';
+		return false;
+	}
+
+	$allowed_attr = $allowed_html[ $element_low ];
 
-	$name_low = strtolower( $name );
 	if ( ! isset( $allowed_attr[ $name_low ] ) || '' == $allowed_attr[ $name_low ] ) {
 		/*
 		 * Allow `data-*` attributes.