diff options
Diffstat (limited to 'srcs/wordpress/wp-includes/kses.php')
| -rw-r--r-- | srcs/wordpress/wp-includes/kses.php | 2332 |
1 files changed, 2332 insertions, 0 deletions
diff --git a/srcs/wordpress/wp-includes/kses.php b/srcs/wordpress/wp-includes/kses.php new file mode 100644 index 0000000..d2f3cbb --- /dev/null +++ b/srcs/wordpress/wp-includes/kses.php @@ -0,0 +1,2332 @@ +<?php +/** + * kses 0.2.2 - HTML/XHTML filter that only allows some elements and attributes + * Copyright (C) 2002, 2003, 2005 Ulf Harnhammar + * + * This program is free software and open source software; you can redistribute + * it and/or modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of the License, + * or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * http://www.gnu.org/licenses/gpl.html + * + * [kses strips evil scripts!] + * + * Added wp_ prefix to avoid conflicts with existing kses users + * + * @version 0.2.2 + * @copyright (C) 2002, 2003, 2005 + * @author Ulf Harnhammar <http://advogato.org/person/metaur/> + * + * @package External + * @subpackage KSES + */ + +/** + * Specifies the default allowable HTML tags. + * + * Using `CUSTOM_TAGS` is not recommended and should be considered deprecated. The + * {@see 'wp_kses_allowed_html'} filter is more powerful and supplies context. + * + * @see wp_kses_allowed_html() + * @since 1.2.0 + * + * @var array[]|bool Array of default allowable HTML tags, or false to use the defaults. + */ +if ( ! defined( 'CUSTOM_TAGS' ) ) { + define( 'CUSTOM_TAGS', false ); +} + +// Ensure that these variables are added to the global namespace +// (e.g. if using namespaces / autoload in the current PHP environment). +global $allowedposttags, $allowedtags, $allowedentitynames; + +if ( ! CUSTOM_TAGS ) { + /** + * KSES global for default allowable HTML tags. + * + * Can be overridden with the `CUSTOM_TAGS` constant. + * + * @var array[] $allowedposttags Array of default allowable HTML tags. + * @since 2.0.0 + */ + $allowedposttags = array( + 'address' => array(), + 'a' => array( + 'href' => true, + 'rel' => true, + 'rev' => true, + 'name' => true, + 'target' => true, + 'download' => array( + 'valueless' => 'y', + ), + ), + 'abbr' => array(), + 'acronym' => array(), + 'area' => array( + 'alt' => true, + 'coords' => true, + 'href' => true, + 'nohref' => true, + 'shape' => true, + 'target' => true, + ), + 'article' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'aside' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'audio' => array( + 'autoplay' => true, + 'controls' => true, + 'loop' => true, + 'muted' => true, + 'preload' => true, + 'src' => true, + ), + 'b' => array(), + 'bdo' => array( + 'dir' => true, + ), + 'big' => array(), + 'blockquote' => array( + 'cite' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'br' => array(), + 'button' => array( + 'disabled' => true, + 'name' => true, + 'type' => true, + 'value' => true, + ), + 'caption' => array( + 'align' => true, + ), + 'cite' => array( + 'dir' => true, + 'lang' => true, + ), + 'code' => array(), + 'col' => array( + 'align' => true, + 'char' => true, + 'charoff' => true, + 'span' => true, + 'dir' => true, + 'valign' => true, + 'width' => true, + ), + 'colgroup' => array( + 'align' => true, + 'char' => true, + 'charoff' => true, + 'span' => true, + 'valign' => true, + 'width' => true, + ), + 'del' => array( + 'datetime' => true, + ), + 'dd' => array(), + 'dfn' => array(), + 'details' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'open' => true, + 'xml:lang' => true, + ), + 'div' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'dl' => array(), + 'dt' => array(), + 'em' => array(), + 'fieldset' => array(), + 'figure' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'figcaption' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'font' => array( + 'color' => true, + 'face' => true, + 'size' => true, + ), + 'footer' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'h1' => array( + 'align' => true, + ), + 'h2' => array( + 'align' => true, + ), + 'h3' => array( + 'align' => true, + ), + 'h4' => array( + 'align' => true, + ), + 'h5' => array( + 'align' => true, + ), + 'h6' => array( + 'align' => true, + ), + 'header' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'hgroup' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'hr' => array( + 'align' => true, + 'noshade' => true, + 'size' => true, + 'width' => true, + ), + 'i' => array(), + 'img' => array( + 'alt' => true, + 'align' => true, + 'border' => true, + 'height' => true, + 'hspace' => true, + 'longdesc' => true, + 'vspace' => true, + 'src' => true, + 'usemap' => true, + 'width' => true, + ), + 'ins' => array( + 'datetime' => true, + 'cite' => true, + ), + 'kbd' => array(), + 'label' => array( + 'for' => true, + ), + 'legend' => array( + 'align' => true, + ), + 'li' => array( + 'align' => true, + 'value' => true, + ), + 'map' => array( + 'name' => true, + ), + 'mark' => array(), + 'menu' => array( + 'type' => true, + ), + 'nav' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'p' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'pre' => array( + 'width' => true, + ), + 'q' => array( + 'cite' => true, + ), + 's' => array(), + 'samp' => array(), + 'span' => array( + 'dir' => true, + 'align' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'section' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'small' => array(), + 'strike' => array(), + 'strong' => array(), + 'sub' => array(), + 'summary' => array( + 'align' => true, + 'dir' => true, + 'lang' => true, + 'xml:lang' => true, + ), + 'sup' => array(), + 'table' => array( + 'align' => true, + 'bgcolor' => true, + 'border' => true, + 'cellpadding' => true, + 'cellspacing' => true, + 'dir' => true, + 'rules' => true, + 'summary' => true, + 'width' => true, + ), + 'tbody' => array( + 'align' => true, + 'char' => true, + 'charoff' => true, + 'valign' => true, + ), + 'td' => array( + 'abbr' => true, + 'align' => true, + 'axis' => true, + 'bgcolor' => true, + 'char' => true, + 'charoff' => true, + 'colspan' => true, + 'dir' => true, + 'headers' => true, + 'height' => true, + 'nowrap' => true, + 'rowspan' => true, + 'scope' => true, + 'valign' => true, + 'width' => true, + ), + 'textarea' => array( + 'cols' => true, + 'rows' => true, + 'disabled' => true, + 'name' => true, + 'readonly' => true, + ), + 'tfoot' => array( + 'align' => true, + 'char' => true, + 'charoff' => true, + 'valign' => true, + ), + 'th' => array( + 'abbr' => true, + 'align' => true, + 'axis' => true, + 'bgcolor' => true, + 'char' => true, + 'charoff' => true, + 'colspan' => true, + 'headers' => true, + 'height' => true, + 'nowrap' => true, + 'rowspan' => true, + 'scope' => true, + 'valign' => true, + 'width' => true, + ), + 'thead' => array( + 'align' => true, + 'char' => true, + 'charoff' => true, + 'valign' => true, + ), + 'title' => array(), + 'tr' => array( + 'align' => true, + 'bgcolor' => true, + 'char' => true, + 'charoff' => true, + 'valign' => true, + ), + 'track' => array( + 'default' => true, + 'kind' => true, + 'label' => true, + 'src' => true, + 'srclang' => true, + ), + 'tt' => array(), + 'u' => array(), + 'ul' => array( + 'type' => true, + ), + 'ol' => array( + 'start' => true, + 'type' => true, + 'reversed' => true, + ), + 'var' => array(), + 'video' => array( + 'autoplay' => true, + 'controls' => true, + 'height' => true, + 'loop' => true, + 'muted' => true, + 'poster' => true, + 'preload' => true, + 'src' => true, + 'width' => true, + ), + ); + + /** + * @var array[] $allowedtags Array of KSES allowed HTML elements. + * @since 1.0.0 + */ + $allowedtags = array( + 'a' => array( + 'href' => true, + 'title' => true, + ), + 'abbr' => array( + 'title' => true, + ), + 'acronym' => array( + 'title' => true, + ), + 'b' => array(), + 'blockquote' => array( + 'cite' => true, + ), + 'cite' => array(), + 'code' => array(), + 'del' => array( + 'datetime' => true, + ), + 'em' => array(), + 'i' => array(), + 'q' => array( + 'cite' => true, + ), + 's' => array(), + 'strike' => array(), + 'strong' => array(), + ); + + /** + * @var string[] $allowedentitynames Array of KSES allowed HTML entitity names. + * @since 1.0.0 + */ + $allowedentitynames = array( + 'nbsp', + 'iexcl', + 'cent', + 'pound', + 'curren', + 'yen', + 'brvbar', + 'sect', + 'uml', + 'copy', + 'ordf', + 'laquo', + 'not', + 'shy', + 'reg', + 'macr', + 'deg', + 'plusmn', + 'acute', + 'micro', + 'para', + 'middot', + 'cedil', + 'ordm', + 'raquo', + 'iquest', + 'Agrave', + 'Aacute', + 'Acirc', + 'Atilde', + 'Auml', + 'Aring', + 'AElig', + 'Ccedil', + 'Egrave', + 'Eacute', + 'Ecirc', + 'Euml', + 'Igrave', + 'Iacute', + 'Icirc', + 'Iuml', + 'ETH', + 'Ntilde', + 'Ograve', + 'Oacute', + 'Ocirc', + 'Otilde', + 'Ouml', + 'times', + 'Oslash', + 'Ugrave', + 'Uacute', + 'Ucirc', + 'Uuml', + 'Yacute', + 'THORN', + 'szlig', + 'agrave', + 'aacute', + 'acirc', + 'atilde', + 'auml', + 'aring', + 'aelig', + 'ccedil', + 'egrave', + 'eacute', + 'ecirc', + 'euml', + 'igrave', + 'iacute', + 'icirc', + 'iuml', + 'eth', + 'ntilde', + 'ograve', + 'oacute', + 'ocirc', + 'otilde', + 'ouml', + 'divide', + 'oslash', + 'ugrave', + 'uacute', + 'ucirc', + 'uuml', + 'yacute', + 'thorn', + 'yuml', + 'quot', + 'amp', + 'lt', + 'gt', + 'apos', + 'OElig', + 'oelig', + 'Scaron', + 'scaron', + 'Yuml', + 'circ', + 'tilde', + 'ensp', + 'emsp', + 'thinsp', + 'zwnj', + 'zwj', + 'lrm', + 'rlm', + 'ndash', + 'mdash', + 'lsquo', + 'rsquo', + 'sbquo', + 'ldquo', + 'rdquo', + 'bdquo', + 'dagger', + 'Dagger', + 'permil', + 'lsaquo', + 'rsaquo', + 'euro', + 'fnof', + 'Alpha', + 'Beta', + 'Gamma', + 'Delta', + 'Epsilon', + 'Zeta', + 'Eta', + 'Theta', + 'Iota', + 'Kappa', + 'Lambda', + 'Mu', + 'Nu', + 'Xi', + 'Omicron', + 'Pi', + 'Rho', + 'Sigma', + 'Tau', + 'Upsilon', + 'Phi', + 'Chi', + 'Psi', + 'Omega', + 'alpha', + 'beta', + 'gamma', + 'delta', + 'epsilon', + 'zeta', + 'eta', + 'theta', + 'iota', + 'kappa', + 'lambda', + 'mu', + 'nu', + 'xi', + 'omicron', + 'pi', + 'rho', + 'sigmaf', + 'sigma', + 'tau', + 'upsilon', + 'phi', + 'chi', + 'psi', + 'omega', + 'thetasym', + 'upsih', + 'piv', + 'bull', + 'hellip', + 'prime', + 'Prime', + 'oline', + 'frasl', + 'weierp', + 'image', + 'real', + 'trade', + 'alefsym', + 'larr', + 'uarr', + 'rarr', + 'darr', + 'harr', + 'crarr', + 'lArr', + 'uArr', + 'rArr', + 'dArr', + 'hArr', + 'forall', + 'part', + 'exist', + 'empty', + 'nabla', + 'isin', + 'notin', + 'ni', + 'prod', + 'sum', + 'minus', + 'lowast', + 'radic', + 'prop', + 'infin', + 'ang', + 'and', + 'or', + 'cap', + 'cup', + 'int', + 'sim', + 'cong', + 'asymp', + 'ne', + 'equiv', + 'le', + 'ge', + 'sub', + 'sup', + 'nsub', + 'sube', + 'supe', + 'oplus', + 'otimes', + 'perp', + 'sdot', + 'lceil', + 'rceil', + 'lfloor', + 'rfloor', + 'lang', + 'rang', + 'loz', + 'spades', + 'clubs', + 'hearts', + 'diams', + 'sup1', + 'sup2', + 'sup3', + 'frac14', + 'frac12', + 'frac34', + 'there4', + ); + + $allowedposttags = array_map( '_wp_add_global_attributes', $allowedposttags ); +} else { + $allowedtags = wp_kses_array_lc( $allowedtags ); + $allowedposttags = wp_kses_array_lc( $allowedposttags ); +} + +/** + * Filters text content and strips out disallowed HTML. + * + * This function makes sure that only the allowed HTML element names, attribute + * names, attribute values, and HTML entities will occur in the given text string. + * + * This function expects unslashed data. + * + * @see wp_kses_post() for specifically filtering post content and fields. + * @see wp_allowed_protocols() for the default allowed protocols in link URLs. + * + * @since 1.0.0 + * + * @param string $string Text content to filter. + * @param array[]|string $allowed_html An array of allowed HTML elements and attributes, or a + * context name such as 'post'. + * @param string[] $allowed_protocols Array of allowed URL protocols. + * @return string Filtered content containing only the allowed HTML. + */ +function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) { + if ( empty( $allowed_protocols ) ) { + $allowed_protocols = wp_allowed_protocols(); + } + $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) ); + $string = wp_kses_normalize_entities( $string ); + $string = wp_kses_hook( $string, $allowed_html, $allowed_protocols ); + return wp_kses_split( $string, $allowed_html, $allowed_protocols ); +} + +/** + * Filters one HTML attribute and ensures its value is allowed. + * + * This function can escape data in some situations where `wp_kses()` must strip the whole attribute. + * + * @since 4.2.3 + * + * @param string $string The 'whole' attribute, including name and value. + * @param string $element The HTML element name to which the attribute belongs. + * @return string Filtered attribute. + */ +function wp_kses_one_attr( $string, $element ) { + $uris = wp_kses_uri_attributes(); + $allowed_html = wp_kses_allowed_html( 'post' ); + $allowed_protocols = wp_allowed_protocols(); + $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) ); + + // Preserve leading and trailing whitespace. + $matches = array(); + preg_match( '/^\s*/', $string, $matches ); + $lead = $matches[0]; + preg_match( '/\s*$/', $string, $matches ); + $trail = $matches[0]; + if ( empty( $trail ) ) { + $string = substr( $string, strlen( $lead ) ); + } else { + $string = substr( $string, strlen( $lead ), -strlen( $trail ) ); + } + + // Parse attribute name and value from input. + $split = preg_split( '/\s*=\s*/', $string, 2 ); + $name = $split[0]; + if ( count( $split ) == 2 ) { + $value = $split[1]; + + // Remove quotes surrounding $value. + // Also guarantee correct quoting in $string for this one attribute. + if ( '' == $value ) { + $quote = ''; + } else { + $quote = $value[0]; + } + if ( '"' == $quote || "'" == $quote ) { + if ( substr( $value, -1 ) != $quote ) { + return ''; + } + $value = substr( $value, 1, -1 ); + } else { + $quote = '"'; + } + + // Sanitize quotes, angle braces, and entities. + $value = esc_attr( $value ); + + // Sanitize URI values. + if ( in_array( strtolower( $name ), $uris ) ) { + $value = wp_kses_bad_protocol( $value, $allowed_protocols ); + } + + $string = "$name=$quote$value$quote"; + $vless = 'n'; + } else { + $value = ''; + $vless = 'y'; + } + + // Sanitize attribute by name. + wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html ); + + // Restore whitespace. + return $lead . $string . $trail; +} + +/** + * Returns an array of allowed HTML tags and attributes for a given context. + * + * @since 3.5.0 + * @since 5.0.1 `form` removed as allowable HTML tag. + * + * @global array $allowedposttags + * @global array $allowedtags + * @global array $allowedentitynames + * + * @param string|array $context The context for which to retrieve tags. Allowed values are 'post', + * 'strip', 'data', 'entities', or the name of a field filter such as + * 'pre_user_description'. + * @return array Array of allowed HTML tags and their allowed attributes. + */ +function wp_kses_allowed_html( $context = '' ) { + global $allowedposttags, $allowedtags, $allowedentitynames; + + if ( is_array( $context ) ) { + /** + * Filters the HTML that is allowed for a given context. + * + * @since 3.5.0 + * + * @param array[]|string $context Context to judge allowed tags by. + * @param string $context_type Context name. + */ + return apply_filters( 'wp_kses_allowed_html', $context, 'explicit' ); + } + + switch ( $context ) { + case 'post': + /** This filter is documented in wp-includes/kses.php */ + $tags = apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context ); + + // 5.0.1 removed the `<form>` tag, allow it if a filter is allowing it's sub-elements `<input>` or `<select>`. + if ( ! CUSTOM_TAGS && ! isset( $tags['form'] ) && ( isset( $tags['input'] ) || isset( $tags['select'] ) ) ) { + $tags = $allowedposttags; + + $tags['form'] = array( + 'action' => true, + 'accept' => true, + 'accept-charset' => true, + 'enctype' => true, + 'method' => true, + 'name' => true, + 'target' => true, + ); + + /** This filter is documented in wp-includes/kses.php */ + $tags = apply_filters( 'wp_kses_allowed_html', $tags, $context ); + } + + return $tags; + + case 'user_description': + case 'pre_user_description': + $tags = $allowedtags; + $tags['a']['rel'] = true; + /** This filter is documented in wp-includes/kses.php */ + return apply_filters( 'wp_kses_allowed_html', $tags, $context ); + + case 'strip': + /** This filter is documented in wp-includes/kses.php */ + return apply_filters( 'wp_kses_allowed_html', array(), $context ); + + case 'entities': + /** This filter is documented in wp-includes/kses.php */ + return apply_filters( 'wp_kses_allowed_html', $allowedentitynames, $context ); + + case 'data': + default: + /** This filter is documented in wp-includes/kses.php */ + return apply_filters( 'wp_kses_allowed_html', $allowedtags, $context ); + } +} + +/** + * You add any KSES hooks here. + * + * There is currently only one KSES WordPress hook, {@see 'pre_kses'}, and it is called here. + * All parameters are passed to the hooks and expected to receive a string. + * + * @since 1.0.0 + * + * @param string $string Content to filter through KSES. + * @param array[]|string $allowed_html List of allowed HTML elements. + * @param string[] $allowed_protocols Array of allowed URL protocols. + * @return string Filtered content through {@see 'pre_kses'} hook. + */ +function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) { + /** + * Filters content to be run through kses. + * + * @since 2.3.0 + * + * @param string $string Content to run through KSES. + * @param array[]|string $allowed_html Allowed HTML elements. + * @param string[] $allowed_protocols Array of allowed URL protocols. + */ + return apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols ); +} + +/** + * Returns the version number of KSES. + * + * @since 1.0.0 + * + * @return string KSES version number. + */ +function wp_kses_version() { + return '0.2.2'; +} + +/** + * Searches for HTML tags, no matter how malformed. + * + * It also matches stray `>` characters. + * + * @since 1.0.0 + * + * @global array $pass_allowed_html + * @global array $pass_allowed_protocols + * + * @param string $string Content to filter. + * @param array $allowed_html Allowed HTML elements. + * @param string[] $allowed_protocols Array of allowed URL protocols. + * @return string Content with fixed HTML tags + */ +function wp_kses_split( $string, $allowed_html, $allowed_protocols ) { + global $pass_allowed_html, $pass_allowed_protocols; + $pass_allowed_html = $allowed_html; + $pass_allowed_protocols = $allowed_protocols; + return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $string ); +} + +/** + * Helper function listing HTML attributes containing a URL. + * + * This function returns a list of all HTML attributes that must contain + * a URL according to the HTML specification. + * + * This list includes URI attributes both allowed and disallowed by KSES. + * + * @link https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes + * + * @since 5.0.1 + * + * @return array HTML attributes that must include a URL. + */ +function wp_kses_uri_attributes() { + $uri_attributes = array( + 'action', + 'archive', + 'background', + 'cite', + 'classid', + 'codebase', + 'data', + 'formaction', + 'href', + 'icon', + 'longdesc', + 'manifest', + 'poster', + 'profile', + 'src', + 'usemap', + 'xmlns', + ); + + /** + * Filters the list of attributes that are required to contain a URL. + * + * Use this filter to add any `data-` attributes that are required to be + * validated as a URL. + * + * @since 5.0.1 + * + * @param array $uri_attributes HTML attributes requiring validation as a URL. + */ + $uri_attributes = apply_filters( 'wp_kses_uri_attributes', $uri_attributes ); + + return $uri_attributes; +} + +/** + * Callback for `wp_kses_split()`. + * + * @since 3.1.0 + * @access private + * @ignore + * + * @global array $pass_allowed_html + * @global array $pass_allowed_protocols + * + * @return string + */ +function _wp_kses_split_callback( $match ) { + global $pass_allowed_html, $pass_allowed_protocols; + return wp_kses_split2( $match[0], $pass_allowed_html, $pass_allowed_protocols ); +} + +/** + * Callback for `wp_kses_split()` for fixing malformed HTML tags. + * + * This function does a lot of work. It rejects some very malformed things like + * `<:::>`. It returns an empty string, if the element isn't allowed (look ma, no + * `strip_tags()`!). Otherwise it splits the tag into an element and an attribute + * list. + * + * After the tag is split into an element and an attribute list, it is run + * through another filter which will remove illegal attributes and once that is + * completed, will be returned. + * + * @access private + * @ignore + * @since 1.0.0 + * + * @param string $string Content to filter. + * @param array $allowed_html Allowed HTML elements. + * @param string[] $allowed_protocols Array of allowed URL protocols. + * @return string Fixed HTML element + */ +function wp_kses_split2( $string, $allowed_html, $allowed_protocols ) { + $string = wp_kses_stripslashes( $string ); + + // It matched a ">" character. + if ( substr( $string, 0, 1 ) != '<' ) { + return '>'; + } + + // Allow HTML comments. + if ( '<!--' == substr( $string, 0, 4 ) ) { + $string = str_replace( array( '<!--', '-->' ), '', $string ); + while ( $string != ( $newstring = wp_kses( $string, $allowed_html, $allowed_protocols ) ) ) { + $string = $newstring; + } + if ( $string == '' ) { + return ''; + } + // prevent multiple dashes in comments + $string = preg_replace( '/--+/', '-', $string ); + // prevent three dashes closing a comment + $string = preg_replace( '/-$/', '', $string ); + return "<!--{$string}-->"; + } + + // It's seriously malformed. + if ( ! preg_match( '%^<\s*(/\s*)?([a-zA-Z0-9-]+)([^>]*)>?$%', $string, $matches ) ) { + return ''; + } + + $slash = trim( $matches[1] ); + $elem = $matches[2]; + $attrlist = $matches[3]; + + if ( ! is_array( $allowed_html ) ) { + $allowed_html = wp_kses_allowed_html( $allowed_html ); + } + + // They are using a not allowed HTML element. + if ( ! isset( $allowed_html[ strtolower( $elem ) ] ) ) { + return ''; + } + + // No attributes are allowed for closing elements. + if ( $slash != '' ) { + return "</$elem>"; + } + + return wp_kses_attr( $elem, $attrlist, $allowed_html, $allowed_protocols ); +} + +/** + * Removes all attributes, if none are allowed for this element. + * + * If some are allowed it calls `wp_kses_hair()` to split them further, and then + * it builds up new HTML code from the data that `kses_hair()` returns. It also + * removes `<` and `>` characters, if there are any left. One more thing it does + * is to check if the tag has a closing XHTML slash, and if it does, it puts one + * in the returned code as well. + * + * @since 1.0.0 + * + * @param string $element HTML element/tag. + * @param string $attr HTML attributes from HTML element to closing HTML element tag. + * @param array $allowed_html Allowed HTML elements. + * @param string[] $allowed_protocols Array of allowed URL protocols. + * @return string Sanitized HTML element. + */ +function wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) { + if ( ! is_array( $allowed_html ) ) { + $allowed_html = wp_kses_allowed_html( $allowed_html ); + } + + // Is there a closing XHTML slash at the end of the attributes? + $xhtml_slash = ''; + if ( preg_match( '%\s*/\s*$%', $attr ) ) { + $xhtml_slash = ' /'; + } + + // Are any attributes allowed at all for this element? + $element_low = strtolower( $element ); + if ( empty( $allowed_html[ $element_low ] ) || true === $allowed_html[ $element_low ] ) { + return "<$element$xhtml_slash>"; + } + + // Split it + $attrarr = wp_kses_hair( $attr, $allowed_protocols ); + + // Go through $attrarr, and save the allowed attributes for this element + // in $attr2 + $attr2 = ''; + foreach ( $attrarr as $arreach ) { + if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) { + $attr2 .= ' ' . $arreach['whole']; + } + } + + // Remove any "<" or ">" characters + $attr2 = preg_replace( '/[<>]/', '', $attr2 ); + + return "<$element$attr2$xhtml_slash>"; +} + +/** + * Determines whether an attribute is allowed. + * + * @since 4.2.3 + * @since 5.0.0 Add support for `data-*` wildcard attributes. + * + * @param string $name The attribute name. Passed by reference. Returns empty string when not allowed. + * @param string $value The attribute value. Passed by reference. Returns a filtered value. + * @param string $whole The `name=value` input. Passed by reference. Returns filtered input. + * @param string $vless Whether the attribute is valueless. Use 'y' or 'n'. + * @param string $element The name of the element to which this attribute belongs. + * @param array $allowed_html The full list of allowed elements and attributes. + * @return bool Whether or not the attribute is allowed. + */ +function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) { + $allowed_attr = $allowed_html[ strtolower( $element ) ]; + + $name_low = strtolower( $name ); + if ( ! isset( $allowed_attr[ $name_low ] ) || '' == $allowed_attr[ $name_low ] ) { + /* + * Allow `data-*` attributes. + * + * When specifying `$allowed_html`, the attribute name should be set as + * `data-*` (not to be mixed with the HTML 4.0 `data` attribute, see + * https://www.w3.org/TR/html40/struct/objects.html#adef-data). + * + * Note: the attribute name should only contain `A-Za-z0-9_-` chars, + * double hyphens `--` are not accepted by WordPress. + */ + if ( strpos( $name_low, 'data-' ) === 0 && ! empty( $allowed_attr['data-*'] ) && preg_match( '/^data(?:-[a-z0-9_]+)+$/', $name_low, $match ) ) { + /* + * Add the whole attribute name to the allowed attributes and set any restrictions + * for the `data-*` attribute values for the current element. + */ + $allowed_attr[ $match[0] ] = $allowed_attr['data-*']; + } else { + $name = ''; + $value = ''; + $whole = ''; + return false; + } + } + + if ( 'style' == $name_low ) { + $new_value = safecss_filter_attr( $value ); + + if ( empty( $new_value ) ) { + $name = ''; + $value = ''; + $whole = ''; + return false; + } + + $whole = str_replace( $value, $new_value, $whole ); + $value = $new_value; + } + + if ( is_array( $allowed_attr[ $name_low ] ) ) { + // there are some checks + foreach ( $allowed_attr[ $name_low ] as $currkey => $currval ) { + if ( ! wp_kses_check_attr_val( $value, $vless, $currkey, $currval ) ) { + $name = ''; + $value = ''; + $whole = ''; + return false; + } + } + } + + return true; +} + +/** + * Builds an attribute list from string containing attributes. + * + * This function does a lot of work. It parses an attribute list into an array + * with attribute data, and tries to do the right thing even if it gets weird + * input. It will add quotes around attribute values that don't have any quotes + * or apostrophes around them, to make it easier to produce HTML code that will + * conform to W3C's HTML specification. It will also remove bad URL protocols + * from attribute values. It also reduces duplicate attributes by using the + * attribute defined first (`foo='bar' foo='baz'` will result in `foo='bar'`). + * + * @since 1.0.0 + * + * @param string $attr Attribute list from HTML element to closing HTML element tag. + * @param string[] $allowed_protocols Array of allowed URL protocols. + * @return array[] Array of attribute information after parsing. + */ +function wp_kses_hair( $attr, $allowed_protocols ) { + $attrarr = array(); + $mode = 0; + $attrname = ''; + $uris = wp_kses_uri_attri |