Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
86021ff
KSES: Reimplement with Tag Processor
dmsnell Aug 25, 2026
ccc9bff
Strip C0 control characters from entire input stream.
dmsnell Sep 8, 2026
7861ee9
New filter `wp_kses_force_legacy_parser` for testing side-by-side.
dmsnell Sep 8, 2026
c89f296
Prevent creating a block delimiter through comment normalization.
dmsnell Aug 31, 2026
fec7968
Reject incorrectly-closed comments entirely.
dmsnell Sep 16, 2026
85c57c2
Process foreign content conservatively
dmsnell Aug 31, 2026
1d5a70b
Try: Track a stack in foreign content.
dmsnell Sep 1, 2026
63475b9
Allow text data inside MathML text elements (MI, MN, MO, MS, MTEXT)
dmsnell Sep 16, 2026
2b11837
Remove unwanted C0 characters from text nodes and attribute values.
dmsnell Aug 31, 2026
48781b3
Revert "Remove unwanted C0 characters from text nodes and attribute v…
dmsnell Sep 9, 2026
70b2065
Use a global to avoid costs of removing and adding deprectaed filters.
dmsnell Sep 15, 2026
368d8ed
Tests: Add idempotency tests.
dmsnell Sep 1, 2026
c109383
Update tests to reflect HTML parsing standards.
dmsnell Aug 25, 2026
5aee71c
Because the title was emptied, the post update failed entirely, leavi…
dmsnell Aug 26, 2026
d999d12
Refactor detection of foreign content exclusions, and relax rules for…
dmsnell Sep 17, 2026
e4f67a3
WIP: Allow character data inside foreign content integration points.
dmsnell Sep 17, 2026
066b8fc
Patch cleanup
dmsnell Sep 17, 2026
55a6908
Prevent stepping into NOSCRIPT elements because of variable parsing r…
dmsnell Sep 19, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/wp-includes/default-filters.php
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,7 @@
add_filter( 'teeny_mce_before_init', '_mce_set_direction' );
add_filter( 'pre_kses', 'wp_pre_kses_less_than' );
add_filter( 'pre_kses', 'wp_pre_kses_block_attributes', 10, 3 );
add_filter( 'wp_kses_force_legacy_parser', '__return_false' );
add_filter( 'sanitize_title', 'sanitize_title_with_dashes', 10, 3 );
add_action( 'check_comment_flood', 'check_comment_flood_db', 10, 4 );
add_filter( 'comment_flood_filter', 'wp_throttle_comment_flood', 10, 3 );
Expand Down
16 changes: 16 additions & 0 deletions src/wp-includes/formatting.php
Original file line number Diff line number Diff line change
Expand Up @@ -5267,10 +5267,18 @@ function wp_parse_str( $input_string, &$result ) {
*
* @since 2.3.0
*
* @global string $wp_kses_operating_mode Indicates if this filter should run.
*
* @param string $content Text to be converted.
* @return string Converted text.
*/
function wp_pre_kses_less_than( $content ) {
global $wp_kses_operating_mode;

if ( 'legacy' !== ( $wp_kses_operating_mode ?? 'legacy' ) ) {
return $content;
}

return preg_replace_callback( '%<[^>]*?((?=<)|>|$)%', 'wp_pre_kses_less_than_callback', $content );
}

Expand All @@ -5295,6 +5303,8 @@ function wp_pre_kses_less_than_callback( $matches ) {
*
* @since 5.3.1
*
* @global string $wp_kses_operating_mode Indicates if this filter should run.
*
* @param string $content Content to be run through KSES.
* @param array[]|string $allowed_html An array of allowed HTML elements
* and attributes, or a context name
Expand All @@ -5303,6 +5313,12 @@ function wp_pre_kses_less_than_callback( $matches ) {
* @return string Filtered text to run through KSES.
*/
function wp_pre_kses_block_attributes( $content, $allowed_html, $allowed_protocols ) {
global $wp_kses_operating_mode;

if ( 'legacy' !== ( $wp_kses_operating_mode ?? 'legacy' ) ) {
return $content;
}

/*
* `filter_block_content` is expected to call `wp_kses`. Temporarily remove
* the filter to avoid recursion.
Expand Down
Loading
Loading