#37208: Comment blacklist can be bypassed with HTML
---------------------------------------------+--------------------------
Reporter: cfinke | Owner: rachelbaker
Type: defect (bug) | Status: closed
Priority: normal | Milestone: 4.6
Component: Comments | Version: 1.5
Severity: normal | Resolution: fixed
Keywords: has-patch has-unit-tests commit | Focuses:
---------------------------------------------+--------------------------
Changes (by rachelbaker):
* owner: => rachelbaker
* status: new => closed
* resolution: => fixed
Comment:
In [changeset:"38047"]:
{{{
#!CommitTicketReference repository="" revision="38047"
Comments: Strip html tags from comment content before blacklist_keys
comparison.
Use `wp_kses()` to clean comment_content for preg_match against the
blacklist_keys. Also includes some initial unit tests for
`wp_blacklist_check()`.
Previously, if a blacklisted key was used in comment_content split by an
html tag the regex in `wp_blacklist_check()` would not find a match.
Example: Where "springfield" was a blacklisted word, if the content of a
comment included `spring<i>field</i>" `wp_blacklist_check()` would not
return true.
Props cfinke.
Fixes #37208.
}}}
--
Ticket URL: <https://core.trac.wordpress.org/ticket/37208#comment:6>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform