[wp-trac] [WordPress Trac] #37208: Comment blacklist can be bypassed with HTML

[WordPress Trac]

#37208: Comment blacklist can be bypassed with HTML
--------------------------+-----------------------------
 Reporter:  cfinke        |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Comments      |    Version:  trunk
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 If the comment blacklist contains the entry "bannedword", users can still
 post comments containing (or appearing to contain) "bannedword" by using
 HTML:

 {{{
 <b>banned</b>word
 banned<b></b>word
 banned<b>word</b>
 }}}

 A solution: `wp_blacklist_check()` could run `wp_kses()` before looking
 for blacklist entries. Patch attached.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/37208>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform