@@ -1088,16 +1088,20 @@ function wp_kses_split2( $content, $allowed_html, $allowed_protocols ) {
10881088 // Allow HTML comments.
10891089 if ( str_starts_with ( $ content , '<!-- ' ) ) {
10901090 $ content = str_replace ( array ( '<!-- ' , '--> ' ), '' , $ content );
1091- while ( ( $ newstring = wp_kses ( $ content , $ allowed_html , $ allowed_protocols ) ) != $ content ) {
1091+
1092+ while ( ( $ newstring = wp_kses ( $ content , $ allowed_html , $ allowed_protocols ) ) !== $ content ) {
10921093 $ content = $ newstring ;
10931094 }
1095+
10941096 if ( '' === $ content ) {
10951097 return '' ;
10961098 }
1099+
10971100 // Prevent multiple dashes in comments.
10981101 $ content = preg_replace ( '/--+/ ' , '- ' , $ content );
10991102 // Prevent three dashes closing a comment.
11001103 $ content = preg_replace ( '/-$/ ' , '' , $ content );
1104+
11011105 return "<!-- {$ content }--> " ;
11021106 }
11031107
@@ -1357,6 +1361,7 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
13571361 if ( preg_match ( '/^\s+/ ' , $ attr ) ) { // Valueless.
13581362 $ working = 1 ;
13591363 $ mode = 0 ;
1364+
13601365 if ( false === array_key_exists ( $ attrname , $ attrarr ) ) {
13611366 $ attrarr [ $ attrname ] = array (
13621367 'name ' => $ attrname ,
@@ -1365,6 +1370,7 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
13651370 'vless ' => 'y ' ,
13661371 );
13671372 }
1373+
13681374 $ attr = preg_replace ( '/^\s+/ ' , '' , $ attr );
13691375 }
13701376
@@ -1386,6 +1392,7 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
13861392 'vless ' => 'n ' ,
13871393 );
13881394 }
1395+
13891396 $ working = 1 ;
13901397 $ mode = 0 ;
13911398 $ attr = preg_replace ( '/^"[^"]*"(\s+|$)/ ' , '' , $ attr );
@@ -1407,6 +1414,7 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
14071414 'vless ' => 'n ' ,
14081415 );
14091416 }
1417+
14101418 $ working = 1 ;
14111419 $ mode = 0 ;
14121420 $ attr = preg_replace ( "/^'[^']*'(\s+|$)/ " , '' , $ attr );
@@ -1428,6 +1436,7 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
14281436 'vless ' => 'n ' ,
14291437 );
14301438 }
1439+
14311440 // We add quotes to conform to W3C's HTML spec.
14321441 $ working = 1 ;
14331442 $ mode = 0 ;
@@ -1437,13 +1446,13 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
14371446 break ;
14381447 } // End switch.
14391448
1440- if ( 0 == $ working ) { // Not well-formed, remove and try again.
1449+ if ( 0 === $ working ) { // Not well-formed, remove and try again.
14411450 $ attr = wp_kses_html_error ( $ attr );
14421451 $ mode = 0 ;
14431452 }
14441453 } // End while.
14451454
1446- if ( 1 == $ mode && false === array_key_exists ( $ attrname , $ attrarr ) ) {
1455+ if ( 1 === $ mode && false === array_key_exists ( $ attrname , $ attrarr ) ) {
14471456 /*
14481457 * Special case, for when the attribute list ends with a valueless
14491458 * attribute like "selected".
@@ -1707,9 +1716,9 @@ function wp_kses_bad_protocol( $content, $allowed_protocols ) {
17071716 do {
17081717 $ original_content = $ content ;
17091718 $ content = wp_kses_bad_protocol_once ( $ content , $ allowed_protocols );
1710- } while ( $ original_content != $ content && ++$ iterations < 6 );
1719+ } while ( $ original_content !== $ content && ++$ iterations < 6 );
17111720
1712- if ( $ original_content != $ content ) {
1721+ if ( $ original_content !== $ content ) {
17131722 return '' ;
17141723 }
17151724
@@ -1974,6 +1983,7 @@ function wp_kses_normalize_entities2( $matches ) {
19741983 }
19751984
19761985 $ i = $ matches [1 ];
1986+
19771987 if ( valid_unicode ( $ i ) ) {
19781988 $ i = str_pad ( ltrim ( $ i , '0 ' ), 3 , '0 ' , STR_PAD_LEFT );
19791989 $ i = "&# $ i; " ;
@@ -2003,6 +2013,7 @@ function wp_kses_normalize_entities3( $matches ) {
20032013 }
20042014
20052015 $ hexchars = $ matches [1 ];
2016+
20062017 return ( ! valid_unicode ( hexdec ( $ hexchars ) ) ) ? "&#x $ hexchars; " : '&#x ' . ltrim ( $ hexchars , '0 ' ) . '; ' ;
20072018}
20082019
@@ -2015,10 +2026,13 @@ function wp_kses_normalize_entities3( $matches ) {
20152026 * @return bool Whether or not the codepoint is a valid Unicode codepoint.
20162027 */
20172028function valid_unicode ( $ i ) {
2018- return ( 0x9 == $ i || 0xa == $ i || 0xd == $ i ||
2019- ( 0x20 <= $ i && $ i <= 0xd7ff ) ||
2020- ( 0xe000 <= $ i && $ i <= 0xfffd ) ||
2021- ( 0x10000 <= $ i && $ i <= 0x10ffff ) );
2029+ $ i = (int ) $ i ;
2030+
2031+ return ( 0x9 === $ i || 0xa === $ i || 0xd === $ i ||
2032+ ( 0x20 <= $ i && $ i <= 0xd7ff ) ||
2033+ ( 0xe000 <= $ i && $ i <= 0xfffd ) ||
2034+ ( 0x10000 <= $ i && $ i <= 0x10ffff )
2035+ );
20222036}
20232037
20242038/**
0 commit comments