[wp-trac] [WordPress Trac] #37208: Comment blacklist can be bypassed with HTML

[WordPress Trac]

#37208: Comment blacklist can be bypassed with HTML
---------------------------------------------+--------------------------
 Reporter:  cfinke                           |       Owner:  rachelbaker
     Type:  defect (bug)                     |      Status:  closed
 Priority:  normal                           |   Milestone:  4.6
Component:  Comments                         |     Version:  1.5
 Severity:  normal                           |  Resolution:  fixed
 Keywords:  has-patch has-unit-tests commit  |     Focuses:
---------------------------------------------+--------------------------

Comment (by cfinke):

 Replying to [comment:8 dd32]:
 > @rachelbaker @cfinke Should this just use `wp_strip_all_tags()` instead
 of `wp_kses()`?  KSes is designed to limit to a whitelist, if you want no
 tags, might as well just strip them entirely.

 I wasn't aware of `wp_strip_all_tags()`, but it does seem more
 appropriate.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/37208#comment:9>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform