KSES: Reimplement with Tag Processor - #13271

Open

dmsnell wants to merge 31 commits into

WordPress:trunkfrom

dmsnell:kses/dual-with-tag-processor

Commits on Oct 2, 2026

KSES: Reimplement with Tag Processor

dmsnell
and
Jon Surrell
committed
690ed3a
Strip C0 control characters from entire input stream.
dmsnell
committed
8a0163a
New filter `wp_kses_force_legacy_parser` for testing side-by-side.
dmsnell
committed
a309505
Prevent creating a block delimiter through comment normalization.
dmsnell
committed
0c701a6
Reject incorrectly-closed comments entirely.
dmsnell
committed
d0fa3e4
Process foreign content conservatively
dmsnell
committed
eddb5c1
Try: Track a stack in foreign content.
dmsnell
committed
4e70511
Allow text data inside MathML text elements (MI, MN, MO, MS, MTEXT)
dmsnell
committed
1557dcf
Remove unwanted C0 characters from text nodes and attribute values.
dmsnell
committed
784e235
Revert "Remove unwanted C0 characters from text nodes and attribute values."
dmsnell
committed
8366627
Use a global to avoid costs of removing and adding deprectaed filters.
dmsnell
committed
275a46d
Tests: Add idempotency tests.

dmsnell
and
sirreal
committed
c324493
Update tests to reflect HTML parsing standards.
dmsnell
committed
7035967
Because the title was emptied, the post update failed entirely, leaving the original content.
dmsnell
committed
cb41e75
Refactor detection of foreign content exclusions, and relax rules for text nodes.
dmsnell
committed
684b09a
WIP: Allow character data inside foreign content integration points.
dmsnell
committed
0c2f809
Patch cleanup
dmsnell
committed
14a068a
Prevent stepping into NOSCRIPT elements because of variable parsing rules.
dmsnell
committed
ebacf78
Track specified allowed HTML context for filters’ sake.
dmsnell
committed
40081eb
Patch cleanup
dmsnell
committed
2542111
Preserve newlines in PRE, LISTING, and TEXTAREA
dmsnell
committed
271df78
Ensure KSES operating mode always resets.
dmsnell
committed
58b11ad
Prevent sending RAWTEXT content containing block delimiters.
dmsnell
committed
4dcf6c4
More updates
dmsnell
committed
b3ab310
Track and close open blocks.
dmsnell
committed
d42c02b
Close blocks that were closed inside truncated foreign content.
dmsnell
committed
7262b44
Optimize integration point detection.
dmsnell
committed
24e9055
Testing: Force legacy wp_kses()
dmsnell
committed
c8dcbd0
Mark as access private to discourage use.
dmsnell
committed
cdf1a9a
Update comments
dmsnell
committed
f340c08
Rewrite PLAINTEXT content as escaped text.
dmsnell
committed
275e4e3

Navigation Menu

KSES: Reimplement with Tag Processor - #13271

KSES: Reimplement with Tag Processor#13271
dmsnell wants to merge 31 commits into
WordPress:trunkfrom
dmsnell:kses/dual-with-tag-processor

Commits on Oct 2, 2026

KSES: Reimplement with Tag Processor

Strip C0 control characters from entire input stream.

New filter `wp_kses_force_legacy_parser` for testing side-by-side.

Prevent creating a block delimiter through comment normalization.

Reject incorrectly-closed comments entirely.

Process foreign content conservatively

Try: Track a stack in foreign content.

Allow text data inside MathML text elements (MI, MN, MO, MS, MTEXT)

Remove unwanted C0 characters from text nodes and attribute values.

Revert "Remove unwanted C0 characters from text nodes and attribute values."

Use a global to avoid costs of removing and adding deprectaed filters.

Tests: Add idempotency tests.

Update tests to reflect HTML parsing standards.

Because the title was emptied, the post update failed entirely, leaving the original content.

Refactor detection of foreign content exclusions, and relax rules for text nodes.

WIP: Allow character data inside foreign content integration points.

Patch cleanup

Prevent stepping into NOSCRIPT elements because of variable parsing rules.

Track specified allowed HTML context for filters’ sake.

Patch cleanup

Preserve newlines in PRE, LISTING, and TEXTAREA

Ensure KSES operating mode always resets.

Prevent sending RAWTEXT content containing block delimiters.

More updates

Track and close open blocks.

Close blocks that were closed inside truncated foreign content.

Optimize integration point detection.

Testing: Force legacy wp_kses()

Mark as access private to discourage use.

Update comments

Rewrite PLAINTEXT content as escaped text.