From 63e76ee31037dc3a27cac8cc201c7eccf421bf80 Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Tue, 10 Mar 2026 12:28:40 +0000 Subject: [PATCH] KSES: Optimize PCRE pattern detecting numeric character references. Props dmsnell, xknown, johnbillion. Built from https://develop.svn.wordpress.org/trunk@61882 git-svn-id: http://core.svn.wordpress.org/trunk@61164 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/kses.php | 4 ++-- wp-includes/version.php | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/wp-includes/kses.php b/wp-includes/kses.php index ed2f96503a..062f853085 100644 --- a/wp-includes/kses.php +++ b/wp-includes/kses.php @@ -2118,8 +2118,8 @@ function wp_kses_normalize_entities( $content, $context = 'html' ) { * * Here, each input is normalized to an appropriate output. */ - $content = preg_replace_callback( '/&#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $content ); - $content = preg_replace_callback( '/&#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $content ); + $content = preg_replace_callback( '/&#(0*[1-9][0-9]{0,6});/', 'wp_kses_normalize_entities2', $content ); + $content = preg_replace_callback( '/&#[Xx](0*[1-9A-Fa-f][0-9A-Fa-f]{0,5});/', 'wp_kses_normalize_entities3', $content ); if ( 'xml' === $context ) { $content = preg_replace_callback( '/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_xml_named_entities', $content ); } else { diff --git a/wp-includes/version.php b/wp-includes/version.php index 30a169b7a5..5ddd47f4e1 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -16,7 +16,7 @@ * * @global string $wp_version */ -$wp_version = '7.0-beta3-61881'; +$wp_version = '7.0-beta3-61882'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.