Skip to content

KSES: Reimplement with Tag Processor #13271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dmsnell wants to merge 9 commits into
base: trunk
Choose a base branch
from
Open

KSES: Reimplement with Tag Processor #13271

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
482cacd
KSES: Reimplement with Tag Processor
dmsnell Aug 25, 2026
5716605
Prevent creating a block delimiter through comment normalization.
dmsnell Aug 31, 2026
73fa1dc
Process foreign content conservatively
dmsnell Aug 31, 2026
f0433cf
Try: Track a stack in foreign content.
dmsnell Sep 1, 2026
ac6058e
Preserve `wp_kses()` comment-content corruption defect.
dmsnell Aug 31, 2026
6cfbc40
Remove unwanted C0 characters from text nodes and attribute values.
dmsnell Aug 31, 2026
7ee648c
Tests: Add idempotency tests.
dmsnell Sep 1, 2026
b40b138
Update tests to reflect HTML parsing standards.
dmsnell Aug 25, 2026
94dac97
Because the title was emptied, the post update failed entirely, leavi…
dmsnell Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
756 changes: 755 additions & 1 deletion src/wp-includes/kses.php
View file
Open in desktop

Large diffs are not rendered by default.

8 changes: 4 additions & 4 deletions tests/phpunit/tests/admin/includesTemplate.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,14 +350,14 @@ public function data_extra_args_for_add_settings_section() {
),
'disallowed tag in before_section' => array(
array(
'before_section' => '<div class="video-settings-section"><iframe src="https://www.wordpress.org/" />',
'before_section' => '<div class="video-settings-section"><iframe src="https://www.wordpress.org/"></iframe>',
'after_section' => '</div><!-- end of the test section -->',
),
array(
'id' => 'test-section',
'title' => 'Section title',
'callback' => '__return_false',
'before_section' => '<div class="video-settings-section"><iframe src="https://www.wordpress.org/" />',
'before_section' => '<div class="video-settings-section"><iframe src="https://www.wordpress.org/"></iframe>',
'after_section' => '</div><!-- end of the test section -->',
'section_class' => '',
),
Expand All @@ -367,14 +367,14 @@ public function data_extra_args_for_add_settings_section() {
'disallowed tag in after_section' => array(
array(
'before_section' => '<div class="video-settings-section">',
'after_section' => '</div><iframe src="https://www.wordpress.org/" />',
'after_section' => '</div><iframe src="https://www.wordpress.org/"></iframe>',
),
array(
'id' => 'test-section',
'title' => 'Section title',
'callback' => '__return_false',
'before_section' => '<div class="video-settings-section">',
'after_section' => '</div><iframe src="https://www.wordpress.org/" />',
'after_section' => '</div><iframe src="https://www.wordpress.org/"></iframe>',
'section_class' => '',
),
'<div class="video-settings-section">',
Expand Down
5 changes: 3 additions & 2 deletions tests/phpunit/tests/block-bindings/postMetaSource.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,9 +260,10 @@ public function test_custom_field_with_unsafe_html_is_sanitized() {

$content = $this->get_modified_post_content( '<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"core/post-meta","args":{"key":"tests_unsafe_html_field"}}}}} --><p>Fallback value</p><!-- /wp:paragraph -->' );

$this->assertSame(
'<p class="wp-block-paragraph">alert(&#8220;Unsafe HTML&#8221;)</p>',
$this->assertEqualHTML(
'<p class="wp-block-paragraph"></p>',
$content,
'<body>',
'The post content should not include the script tag.'
);
}
Expand Down
5 changes: 3 additions & 2 deletions tests/phpunit/tests/block-bindings/render.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,7 @@ function ( $source_args, $block_instance, $attribute_name ) {
function () {
return '<script>alert("Unsafe HTML")</script>';
},
'<p class="wp-block-paragraph">alert("Unsafe HTML")</p>',
'<p class="wp-block-paragraph"></p>',
),
'symbols and numbers should be rendered correctly' => array(
function () {
Expand Down Expand Up @@ -234,9 +234,10 @@ public function test_different_get_value_callbacks( $get_value_callback, $expect
$block = new WP_Block( $parsed_blocks[0] );
$result = $block->render();

$this->assertSame(
$this->assertEqualHTML(
$expected,
trim( $result ),
'<body>',
'The block content should be updated with the value returned by the source.'
);
}
Expand Down
8 changes: 4 additions & 4 deletions tests/phpunit/tests/customize/manager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1357,11 +1357,11 @@ public function test_save_changeset_post_without_kses_corrupting_json() {

// User saved as one who cannot bypass content_save_pre filter.
$this->assertStringNotContainsString( '<script>', get_option( 'custom_html_2' ) );
$this->assertStringContainsString( 'WordPress', get_option( 'custom_html_2' ) );
$this->assertStringNotContainsString( 'WordPress', get_option( 'custom_html_2' ) );

// User saved as one who also cannot bypass content_save_pre filter.
$this->assertStringNotContainsString( '<script>', get_option( 'custom_html_3' ) );
$this->assertStringContainsString( 'WordPress', get_option( 'custom_html_3' ) );
$this->assertStringNotContainsString( 'WordPress', get_option( 'custom_html_3' ) );
}

/**
Expand Down Expand Up @@ -1991,7 +1991,7 @@ public function test_save_changeset_post_with_varying_unfiltered_html_cap() {
$wp_customize = new WP_Customize_Manager( array( 'changeset_uuid' => $wp_customize->changeset_uuid() ) );
do_action( 'customize_register', $wp_customize );
$wp_customize->save_changeset_post( array( 'status' => 'publish' ) );
$this->assertSame( 'Unfilteredevil', get_option( 'scratchpad' ) );
$this->assertSame( 'Unfiltered', get_option( 'scratchpad' ) );

// Attempt publishing scratchpad as anonymous user when changeset was set by privileged user.
update_option( 'scratchpad', '' );
Expand All @@ -2008,7 +2008,7 @@ public function test_save_changeset_post_with_varying_unfiltered_html_cap() {
wp_set_current_user( 0 );
$wp_customize = null;
unset( $GLOBALS['wp_actions']['customize_register'] );
$this->assertSame( 'Unfilteredevil', apply_filters( 'content_save_pre', 'Unfiltered<script>evil</script>' ) );
$this->assertSame( 'Unfiltered', apply_filters( 'content_save_pre', 'Unfiltered<script>evil</script>' ) );
wp_publish_post( $changeset_post_id ); // @todo If wp_update_post() is used here, then kses will corrupt the post_content.
$this->assertSame( 'Unfiltered<script>evil</script>', get_option( 'scratchpad' ) );
}
Expand Down
6 changes: 3 additions & 3 deletions tests/phpunit/tests/customize/nav-menu-item-setting.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -588,11 +588,11 @@ public function test_sanitize() {
'menu_item_parent' => 0,
'position' => -123,
'type' => 'customb',
'title' => current_user_can( 'unfiltered_html' ) ? '\o/ o\'o Hi<script>unfilteredHtml()</script>' : '\o/ o\'o HiunfilteredHtml()',
'title' => current_user_can( 'unfiltered_html' ) ? '\o/ o\'o Hi<script>unfilteredHtml()</script>' : '\o/ o\'o Hi',
'url' => '',
'target' => 'onclick',
'attr_title' => current_user_can( 'unfiltered_html' ) ? '\o/ o\'o <b>bolded</b><script>unfilteredHtml()</script>' : '\o/ o\'o <b>bolded</b>unfilteredHtml()',
'description' => current_user_can( 'unfiltered_html' ) ? '\o/ o\'o <b>Hello world</b><script>unfilteredHtml()</script>' : '\o/ o\'o <b>Hello world</b>unfilteredHtml()',
'attr_title' => current_user_can( 'unfiltered_html' ) ? '\o/ o\'o <b>bolded</b><script>unfilteredHtml()</script>' : '\o/ o\'o <b>bolded</b>',
'description' => current_user_can( 'unfiltered_html' ) ? '\o/ o\'o <b>Hello world</b><script>unfilteredHtml()</script>' : '\o/ o\'o <b>Hello world</b>',
'classes' => 'hello inject',
'xfn' => 'hello inject',
'status' => 'draft',
Expand Down
4 changes: 2 additions & 2 deletions tests/phpunit/tests/formatting/sanitizeTextField.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ public function test_sanitize_text_field( $str, $expected ) {
$expected_oneline = $expected;
$expected_multiline = $expected;
}
$this->assertSame( $expected_oneline, sanitize_text_field( $str ) );
$this->assertEqualHTML( $expected_oneline, sanitize_text_field( $str ) );
$this->assertSameIgnoreEOL( $expected_multiline, sanitize_textarea_field( $str ) );
}

Expand Down Expand Up @@ -55,7 +55,7 @@ public function data_sanitize_text_field() {
array(
"foo <\ndiv\n> bar",
array(
'oneline' => 'foo &lt; div > bar',
'oneline' => 'foo &lt; div &gt; bar',
'multiline' => "foo &lt;\ndiv\n> bar",
),
),
Expand Down
2 changes: 1 addition & 1 deletion tests/phpunit/tests/functions/wpTriggerError.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ public function data_should_trigger_error() {
'disallowed HTML elements are present in message' => array(
'function_name' => 'some_function',
'message' => '<script>alert("expected the function name and message")</script>',
'expected_message' => 'some_function(): alert("expected the function name and message")',
'expected_message' => 'some_function(): ',
),
);
}
Expand Down
1 change: 1 addition & 0 deletions tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -417,6 +417,7 @@ public function test_updates_basic_modifiable_text_on_supported_nodes( string $h
$this->assertSame(
$transformed,
$processor->get_updated_html(),
'<body>',
"Should have transformed the HTML as expected when modifying the target node's modifiable text."
);
}
Expand Down
10 changes: 5 additions & 5 deletions tests/phpunit/tests/icons/wpRestIconsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,11 +333,11 @@ public function test_get_item_returns_specific_icon() {
$this->assertSame( 'core/arrow-left', $data['name'] );
$this->assertSame( 'Arrow Left', $data['label'] );
$this->assertNotEmpty( $data['content'] );
$this->assertStringStartsWith(
'<svg xmlns="',
$data['content'],
'Icon content should match the actual SVG asset'
);

$processor = new WP_HTML_Tag_Processor( $data['content'] );
$this->assertTrue( $processor->next_token() );
$this->assertSame( 'SVG', $processor->get_tag(), 'Icon content should match the actual SVG asset' );
$this->assertSame( 'http://www.w3.org/2000/svg', $processor->get_attribute( 'xmlns' ), 'Icon content should match the actual SVG asset' );
}

/**
Expand Down
Loading
Loading