[wp-trac] [WordPress Trac] #6583: kses Allows Invalid Unicode Numeric Entities

[WordPress Trac]

#6583: kses Allows Invalid Unicode Numeric Entities
----------------------+-----------------------------------------------------
 Reporter:  schiller  |       Owner:  anonymous
     Type:  defect    |      Status:  new      
 Priority:  normal    |   Milestone:  2.7      
Component:  General   |     Version:           
 Severity:  normal    |    Keywords:           
----------------------+-----------------------------------------------------
 wp_kses_normalize_entities() allows a user to type "" in a
 comment.  This is not properly escaped as "".  For bloggers
 outputting true XHTML, this is disastrous.  kses should be modified to
 escape the ampersand in any numeric entity reference that is not a valid
 Unicode character.

-- 
Ticket URL: <http://trac.wordpress.org/ticket/6583>
WordPress Trac <http://trac.wordpress.org/>
WordPress blogging software