Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
31 commits
Select commit Hold shift + click to select a range
690ed3a
KSES: Reimplement with Tag Processor
dmsnell Aug 25, 2026
8a0163a
Strip C0 control characters from entire input stream.
dmsnell Sep 8, 2026
a309505
New filter `wp_kses_force_legacy_parser` for testing side-by-side.
dmsnell Sep 8, 2026
0c701a6
Prevent creating a block delimiter through comment normalization.
dmsnell Aug 31, 2026
d0fa3e4
Reject incorrectly-closed comments entirely.
dmsnell Sep 16, 2026
eddb5c1
Process foreign content conservatively
dmsnell Aug 31, 2026
4e70511
Try: Track a stack in foreign content.
dmsnell Sep 1, 2026
1557dcf
Allow text data inside MathML text elements (MI, MN, MO, MS, MTEXT)
dmsnell Sep 16, 2026
784e235
Remove unwanted C0 characters from text nodes and attribute values.
dmsnell Aug 31, 2026
8366627
Revert "Remove unwanted C0 characters from text nodes and attribute v…
dmsnell Sep 9, 2026
275a46d
Use a global to avoid costs of removing and adding deprectaed filters.
dmsnell Sep 15, 2026
c324493
Tests: Add idempotency tests.
dmsnell Sep 1, 2026
7035967
Update tests to reflect HTML parsing standards.
dmsnell Aug 25, 2026
cb41e75
Because the title was emptied, the post update failed entirely, leavi…
dmsnell Aug 26, 2026
684b09a
Refactor detection of foreign content exclusions, and relax rules for…
dmsnell Sep 17, 2026
0c2f809
WIP: Allow character data inside foreign content integration points.
dmsnell Sep 17, 2026
14a068a
Patch cleanup
dmsnell Sep 17, 2026
ebacf78
Prevent stepping into NOSCRIPT elements because of variable parsing r…
dmsnell Sep 19, 2026
40081eb
Track specified allowed HTML context for filters’ sake.
dmsnell Sep 20, 2026
2542111
Patch cleanup
dmsnell Sep 20, 2026
271df78
Preserve newlines in PRE, LISTING, and TEXTAREA
dmsnell Sep 22, 2026
58b11ad
Ensure KSES operating mode always resets.
dmsnell Sep 22, 2026
4dcf6c4
Prevent sending RAWTEXT content containing block delimiters.
dmsnell Sep 22, 2026
b3ab310
More updates
dmsnell Sep 22, 2026
d42c02b
Track and close open blocks.
dmsnell Sep 23, 2026
7262b44
Close blocks that were closed inside truncated foreign content.
dmsnell Sep 23, 2026
24e9055
Optimize integration point detection.
dmsnell Sep 23, 2026
c8dcbd0
Testing: Force legacy wp_kses()
dmsnell Sep 19, 2026
cdf1a9a
Mark as access private to discourage use.
dmsnell Oct 1, 2026
f340c08
Update comments
dmsnell Oct 1, 2026
275e4e3
Rewrite PLAINTEXT content as escaped text.
dmsnell Oct 1, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/wp-includes/default-filters.php
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,7 @@
add_filter( 'teeny_mce_before_init', '_mce_set_direction' );
add_filter( 'pre_kses', 'wp_pre_kses_less_than' );
add_filter( 'pre_kses', 'wp_pre_kses_block_attributes', 10, 3 );
add_filter( 'wp_kses_force_legacy_parser', '__return_true' );
add_filter( 'sanitize_title', 'sanitize_title_with_dashes', 10, 3 );
add_action( 'check_comment_flood', 'check_comment_flood_db', 10, 4 );
add_filter( 'comment_flood_filter', 'wp_throttle_comment_flood', 10, 3 );
Expand Down
16 changes: 16 additions & 0 deletions src/wp-includes/formatting.php
Original file line number Diff line number Diff line change
Expand Up @@ -5309,10 +5309,18 @@ function wp_parse_str( $input_string, &$result ) {
*
* @since 2.3.0
*
* @global string $wp_kses_operating_mode Indicates if this filter should run.
*
* @param string $content Text to be converted.
* @return string Converted text.
*/
function wp_pre_kses_less_than( $content ) {
global $wp_kses_operating_mode;

if ( 'legacy' !== ( $wp_kses_operating_mode ?? 'legacy' ) ) {
return $content;
}

return preg_replace_callback( '%<[^>]*?((?=<)|>|$)%', 'wp_pre_kses_less_than_callback', $content );
}

Expand All @@ -5337,6 +5345,8 @@ function wp_pre_kses_less_than_callback( $matches ) {
*
* @since 5.3.1
*
* @global string $wp_kses_operating_mode Indicates if this filter should run.
*
* @param string $content Content to be run through KSES.
* @param array[]|string $allowed_html An array of allowed HTML elements
* and attributes, or a context name
Expand All @@ -5345,6 +5355,12 @@ function wp_pre_kses_less_than_callback( $matches ) {
* @return string Filtered text to run through KSES.
*/
function wp_pre_kses_block_attributes( $content, $allowed_html, $allowed_protocols ) {
global $wp_kses_operating_mode;

if ( 'legacy' !== ( $wp_kses_operating_mode ?? 'legacy' ) ) {
return $content;
}

/*
* `filter_block_content` is expected to call `wp_kses`. Temporarily remove
* the filter to avoid recursion.
Expand Down
Loading
Loading