Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-17093: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-12-02T06:29Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/general-template.php, wp-includes/version.php
Commit date: 2017-11-29 15:55:47 +0000
Commit message: Hardening: Add escaping to the language attributes used on `html` elements.

Built from https://develop.svn.wordpress.org/trunk@42259


git-svn-id: http://core.svn.wordpress.org/trunk@42088 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/general-template.php b/wp-includes/general-template.php
index 55db605882c..c5796686151 100644
--- a/wp-includes/general-template.php
+++ b/wp-includes/general-template.php
@@ -3566,16 +3566,18 @@ function get_language_attributes( $doctype = 'html' ) {
 	$attributes = array();
 
 	if ( function_exists( 'is_rtl' ) && is_rtl() )
 		$attributes[] = 'dir="rtl"';
 
-	if ( $lang = get_bloginfo('language') ) {
-		if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
-			$attributes[] = "lang=\"$lang\"";
+	if ( $lang = get_bloginfo( 'language' ) ) {
+		if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
+			$attributes[] = 'lang="' . esc_attr( $lang ) . '"';
+		}
 
-		if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
-			$attributes[] = "xml:lang=\"$lang\"";
+		if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
+			$attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
+		}
 	}
 
 	$output = implode(' ', $attributes);
 
 	/**
diff --git a/wp-includes/version.php b/wp-includes/version.php
index f5f8415d416..3869234559e 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.0-alpha-42258';
+$wp_version = '5.0-alpha-42259';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 	if ( $lang = get_bloginfo('language') ) {
		if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
			$attributes[] = "lang=\"$lang\"";
		if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
			$attributes[] = "xml:lang=\"$lang\"";
$wp_version = '5.0-alpha-42258';
Fixed code: 	if ( $lang = get_bloginfo( 'language' ) ) {
		if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
			$attributes[] = 'lang="' . esc_attr( $lang ) . '"';
		}
		if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
			$attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
		}
$wp_version = '5.0-alpha-42259';
CVE-2017-5487: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2017-01-15T02:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php, wp-includes/version.php
Commit date: 2017-01-11 14:14:42 +0000
Commit message: REST API: Change which users are shown in the users endpoint.

Only show users that have authored a post of a post type that has `show_in_rest` set to true.

Props rachelbaker, jnylen0.
See #38878.


Built from https://develop.svn.wordpress.org/trunk@39843


git-svn-id: http://core.svn.wordpress.org/trunk@39781 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php
index d3d253a38a1..4f6c378a117 100644
--- a/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php
+++ b/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php
@@ -247,11 +247,11 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
 			);
 			$prepared_args['orderby'] = $orderby_possibles[ $request['orderby'] ];
 		}
 
 		if ( ! current_user_can( 'list_users' ) ) {
-			$prepared_args['has_published_posts'] = true;
+			$prepared_args['has_published_posts'] = get_post_types( array( 'show_in_rest' => true ), 'names' );
 		}
 
 		if ( ! empty( $prepared_args['search'] ) ) {
 			$prepared_args['search'] = '*' . $prepared_args['search'] . '*';
 		}
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 6a407d63512..8f300992281 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-39831';
+$wp_version = '4.8-alpha-39843';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 			$prepared_args['has_published_posts'] = true;
$wp_version = '4.8-alpha-39831';
Fixed code: 			$prepared_args['has_published_posts'] = get_post_types( array( 'show_in_rest' => true ), 'names' );
$wp_version = '4.8-alpha-39843';
CVE-2017-5488: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-01-15T02:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/update-core.php, wp-includes/version.php
Commit date: 2017-01-11 10:37:48 +0000
Commit message: Updates: Translate plugin data on the Updates screen.
Built from https://develop.svn.wordpress.org/trunk@39808


git-svn-id: http://core.svn.wordpress.org/trunk@39746 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/update-core.php b/wp-admin/update-core.php
index c6c21ead5c4..a0801b9bade 100644
--- a/wp-admin/update-core.php
+++ b/wp-admin/update-core.php
@@ -248,10 +248,12 @@ function list_plugin_updates() {
 	</thead>
 
 	<tbody class="plugins">
 <?php
 	foreach ( (array) $plugins as $plugin_file => $plugin_data ) {
+		$plugin_data = (object) _get_plugin_data_markup_translate( $plugin_file, (array) $plugin_data, false, true );
+
 		// Get plugin compat for running version of WordPress.
 		if ( isset($plugin_data->update->tested) && version_compare($plugin_data->update->tested, $cur_wp_version, '>=') ) {
 			$compat = '<br />' . sprintf(__('Compatibility with WordPress %1$s: 100%% (according to its author)'), $cur_wp_version);
 		} elseif ( isset($plugin_data->update->compatibility->{$cur_wp_version}) ) {
 			$compat = $plugin_data->update->compatibility->{$cur_wp_version};
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 7bc1c226d2a..f342b0d2902 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-39807';
+$wp_version = '4.8-alpha-39808';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '4.8-alpha-39807';
Fixed code: 		$plugin_data = (object) _get_plugin_data_markup_translate( $plugin_file, (array) $plugin_data, false, true );

$wp_version = '4.8-alpha-39808';
CVE-2017-5490: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-01-15T02:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/class-wp-theme.php, wp-includes/version.php
Commit date: 2017-01-11 10:34:44 +0000
Commit message: Themes: Fix markup for theme name fallbacks.
Built from https://develop.svn.wordpress.org/trunk@39807


git-svn-id: http://core.svn.wordpress.org/trunk@39745 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/class-wp-theme.php b/wp-includes/class-wp-theme.php
index b373307402b..77927d38816 100644
--- a/wp-includes/class-wp-theme.php
+++ b/wp-includes/class-wp-theme.php
@@ -735,12 +735,13 @@ final class WP_Theme implements ArrayAccess {
 	 * @return string Value, marked up.
 	 */
 	private function markup_header( $header, $value, $translate ) {
 		switch ( $header ) {
 			case 'Name' :
-				if ( empty( $value ) )
-					$value = $this->get_stylesheet();
+				if ( empty( $value ) ) {
+					$value = esc_html( $this->get_stylesheet() );
+				}
 				break;
 			case 'Description' :
 				$value = wptexturize( $value );
 				break;
 			case 'Author' :
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 0f6a577daa0..7bc1c226d2a 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-39795';
+$wp_version = '4.8-alpha-39807';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 				if ( empty( $value ) )
					$value = $this->get_stylesheet();
$wp_version = '4.8-alpha-39795';
Fixed code: 				if ( empty( $value ) ) {
					$value = esc_html( $this->get_stylesheet() );
				}
$wp_version = '4.8-alpha-39807';
CVE-2017-5491: Initialization of a Resource with an Insecure Default (CWE-1188)
value: wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
CWE description: The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
CVSS v3 base score: 5.3
Published: 2017-01-15T02:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/version.php, wp-mail.php
Commit date: 2017-01-11 05:13:43 +0000
Commit message: Mail: Disable wp-mail.php when `mailserver_url` is mail.example.com.

Built from https://develop.svn.wordpress.org/trunk@39772


git-svn-id: http://core.svn.wordpress.org/trunk@39710 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/version.php b/wp-includes/version.php
index 25e7cf5e328..58890b89743 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-39760';
+$wp_version = '4.8-alpha-39772';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version
diff --git a/wp-mail.php b/wp-mail.php
index e62bbf12158..35fb24aed26 100644
--- a/wp-mail.php
+++ b/wp-mail.php
@@ -12,10 +12,16 @@ require(dirname(__FILE__) . '/wp-load.php');
 
 /** This filter is documented in wp-admin/options.php */
 if ( ! apply_filters( 'enable_post_by_email_configuration', true ) )
 	wp_die( __( 'This action has been disabled by the administrator.' ), 403 );
 
+$mailserver_url = get_option( 'mailserver_url' );
+
+if ( 'mail.example.com' === $mailserver_url || empty( $mailserver_url ) ) {
+	wp_die( __( 'This action has been disabled by the administrator.' ), 403 );
+}
+
 /**
  * Fires to allow a plugin to do a complete takeover of Post by Email.
  *
  * @since 2.9.0
  */

Vulnerable code: $wp_version = '4.8-alpha-39760';
Fixed code: $wp_version = '4.8-alpha-39772';
$mailserver_url = get_option( 'mailserver_url' );

if ( 'mail.example.com' === $mailserver_url || empty( $mailserver_url ) ) {
	wp_die( __( 'This action has been disabled by the administrator.' ), 403 );
}
CVE-2017-5493: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
value: wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
CWE description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CVSS v3 base score: 7.5
Published: 2017-01-15T02:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/ms-functions.php, wp-includes/version.php
Commit date: 2017-01-11 05:30:42 +0000
Commit message: Multisite: Use `wp_rand()` in signup key creation.

Built from https://develop.svn.wordpress.org/trunk@39795


git-svn-id: http://core.svn.wordpress.org/trunk@39733 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/ms-functions.php b/wp-includes/ms-functions.php
index d0cada38472..07b7c8c30f4 100644
--- a/wp-includes/ms-functions.php
+++ b/wp-includes/ms-functions.php
@@ -667,11 +667,11 @@ function wpmu_validate_blog_signup( $blogname, $blog_title, $user = '' ) {
  * @param array  $meta       By default, contains the requested privacy setting and lang_id.
  */
 function wpmu_signup_blog( $domain, $path, $title, $user, $user_email, $meta = array() )  {
 	global $wpdb;
 
-	$key = substr( md5( time() . rand() . $domain ), 0, 16 );
+	$key = substr( md5( time() . wp_rand() . $domain ), 0, 16 );
 	$meta = serialize($meta);
 
 	$wpdb->insert( $wpdb->signups, array(
 		'domain' => $domain,
 		'path' => $path,
@@ -717,11 +717,11 @@ function wpmu_signup_user( $user, $user_email, $meta = array() ) {
 	global $wpdb;
 
 	// Format data
 	$user = preg_replace( '/\s+/', '', sanitize_user( $user, true ) );
 	$user_email = sanitize_email( $user_email );
-	$key = substr( md5( time() . rand() . $user_email ), 0, 16 );
+	$key = substr( md5( time() . wp_rand() . $user_email ), 0, 16 );
 	$meta = serialize($meta);
 
 	$wpdb->insert( $wpdb->signups, array(
 		'domain' => '',
 		'path' => '',
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 58890b89743..0f6a577daa0 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-39772';
+$wp_version = '4.8-alpha-39795';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 	$key = substr( md5( time() . rand() . $domain ), 0, 16 );
	$key = substr( md5( time() . rand() . $user_email ), 0, 16 );
$wp_version = '4.8-alpha-39772';
Fixed code: 	$key = substr( md5( time() . wp_rand() . $domain ), 0, 16 );
	$key = substr( md5( time() . wp_rand() . $user_email ), 0, 16 );
$wp_version = '4.8-alpha-39795';
CVE-2017-5612: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-01-30T04:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/includes/class-wp-posts-list-table.php, wp-includes/version.php
Commit date: 2017-01-26 13:41:44 +0000
Commit message: Posts, Post Types: When using Excerpt mode on the Posts list table, ensure the excerpt output matches what was manually entered into the Excerpt field.

Built from https://develop.svn.wordpress.org/trunk@39956


git-svn-id: http://core.svn.wordpress.org/trunk@39893 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/includes/class-wp-posts-list-table.php b/wp-admin/includes/class-wp-posts-list-table.php
index a0e4bfc8df6..668c3d20a4c 100644
--- a/wp-admin/includes/class-wp-posts-list-table.php
+++ b/wp-admin/includes/class-wp-posts-list-table.php
@@ -954,11 +954,11 @@ class WP_Posts_List_Table extends WP_List_Table {
 			echo ' | ' . $post_type_object->labels->parent_item_colon . ' ' . esc_html( $parent_name );
 		}
 		echo "</strong>\n";
 
 		if ( ! is_post_type_hierarchical( $this->screen->post_type ) && 'excerpt' === $mode && current_user_can( 'read_post', $post->ID ) ) {
-			the_excerpt();
+			echo esc_html( get_the_excerpt() );
 		}
 
 		get_inline_data( $post );
 	}
 
diff --git a/wp-includes/version.php b/wp-includes/version.php
index c26e7a0fee7..56646674243 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-39954';
+$wp_version = '4.8-alpha-39956';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 			the_excerpt();
$wp_version = '4.8-alpha-39954';
Fixed code: 			echo esc_html( get_the_excerpt() );
$wp_version = '4.8-alpha-39956';
CVE-2017-6814: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-03-12T01:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/includes/media.php, wp-includes/version.php
Commit date: 2017-03-06 08:01:43 +0000
Commit message: Validate video and audio metadata.

Built from https://develop.svn.wordpress.org/trunk@40148


git-svn-id: http://core.svn.wordpress.org/trunk@40087 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index ede25b3df76..d2f4854a2c0 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -3070,10 +3070,12 @@ function wp_read_video_metadata( $file ) {
 		$metadata['audio'] = $data['audio'];
 	}
 
 	wp_add_id3_tag_data( $metadata, $data );
 
+	$metadata = wp_kses_post_deep( $metadata );
+
 	return $metadata;
 }
 
 /**
  * Retrieve metadata from a audio file's ID3 tags
@@ -3115,10 +3117,12 @@ function wp_read_audio_metadata( $file ) {
 	if ( ! empty( $data['playtime_string'] ) )
 		$metadata['length_formatted'] = $data['playtime_string'];
 
 	wp_add_id3_tag_data( $metadata, $data );
 
+	$metadata = wp_kses_post_deep( $metadata );
+
 	return $metadata;
 }
 
 /**
  * Encapsulate logic for Attach/Detach actions
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 23d41651c2e..a54c0193e7d 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-40147';
+$wp_version = '4.8-alpha-40148';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '4.8-alpha-40147';
Fixed code: 	$metadata = wp_kses_post_deep( $metadata );

	$metadata = wp_kses_post_deep( $metadata );

$wp_version = '4.8-alpha-40148';
CVE-2017-6815: Improper Input Validation (CWE-20)
value: In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.1
Published: 2017-03-12T01:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/pluggable.php, wp-includes/version.php
Commit date: 2017-03-06 13:38:41 +0000
Commit message: Strip control characters before validating redirect.


Built from https://develop.svn.wordpress.org/trunk@40183


git-svn-id: http://core.svn.wordpress.org/trunk@40122 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php
index 3e6fbe14d6a..0de6b0cc784 100644
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -1291,11 +1291,11 @@ if ( !function_exists('wp_validate_redirect') ) :
  * @param string $location The redirect to validate
  * @param string $default  The value to return if $location is not allowed
  * @return string redirect-sanitized URL
  **/
 function wp_validate_redirect($location, $default = '') {
-	$location = trim( $location );
+	$location = trim( $location, " \t\n\r\0\x08\x0B" );
 	// browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
 	if ( substr($location, 0, 2) == '//' )
 		$location = 'http:' . $location;
 
 	// In php 5 parse_url may fail if the URL query part contains http://, bug #38143
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 56086c2a266..7db8d5c43af 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-40181';
+$wp_version = '4.8-alpha-40183';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 	$location = trim( $location );
$wp_version = '4.8-alpha-40181';
Fixed code: 	$location = trim( $location, " \t\n\r\0\x08\x0B" );
$wp_version = '4.8-alpha-40183';
CVE-2017-6816: Incorrect Authorization (CWE-863)
value: In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.9
Published: 2017-03-12T01:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/plugins.php, wp-includes/version.php
Commit date: 2017-03-06 12:55:41 +0000
Commit message: Plugins: Add file check to plugin deletions.


Built from https://develop.svn.wordpress.org/trunk@40169


git-svn-id: http://core.svn.wordpress.org/trunk@40108 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/plugins.php b/wp-admin/plugins.php
index 2eeea4eb9f5..3d7ff016e50 100644
--- a/wp-admin/plugins.php
+++ b/wp-admin/plugins.php
@@ -244,10 +244,18 @@ if ( $action ) {
 			if ( empty( $plugins ) ) {
 				wp_redirect( self_admin_url( "plugins.php?error=true&main=true&plugin_status=$status&paged=$page&s=$s" ) );
 				exit;
 			}
 
+			// Bail on all if any paths are invalid.
+			// validate_file() returns truthy for invalid files
+			$invalid_plugin_files = array_filter( $plugins, 'validate_file' );
+			if ( $invalid_plugin_files ) {
+				wp_redirect( self_admin_url("plugins.php?plugin_status=$status&paged=$page&s=$s") );
+				exit;
+			}
+
 			include(ABSPATH . 'wp-admin/update.php');
 
 			$parent_file = 'plugins.php';
 
 			if ( ! isset($_REQUEST['verify-delete']) ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 656a2009194..9f9a17f942b 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-40160';
+$wp_version = '4.8-alpha-40169';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '4.8-alpha-40160';
Fixed code: 			// Bail on all if any paths are invalid.
			// validate_file() returns truthy for invalid files
			$invalid_plugin_files = array_filter( $plugins, 'validate_file' );
			if ( $invalid_plugin_files ) {
				wp_redirect( self_admin_url("plugins.php?plugin_status=$status&paged=$page&s=$s") );
				exit;
			}

$wp_version = '4.8-alpha-40169';
CVE-2017-6817: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-03-12T01:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/embed.php, wp-includes/version.php
Commit date: 2017-03-06 11:42:40 +0000
Commit message: Embeds: URL encode YouTube video IDs for broader compatibility.
Built from https://develop.svn.wordpress.org/trunk@40160


git-svn-id: http://core.svn.wordpress.org/trunk@40099 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/embed.php b/wp-includes/embed.php
index ddd5dd988c8..b987649f527 100644
--- a/wp-includes/embed.php
+++ b/wp-includes/embed.php
@@ -224,11 +224,11 @@ function wp_maybe_load_embeds() {
  * @param array  $rawattr The original unmodified attributes.
  * @return string The embed HTML.
  */
 function wp_embed_handler_youtube( $matches, $attr, $url, $rawattr ) {
 	global $wp_embed;
-	$embed = $wp_embed->autoembed( "https://youtube.com/watch?v={$matches[2]}" );
+	$embed = $wp_embed->autoembed( sprintf( "https://youtube.com/watch?v=%s", urlencode( $matches[2] ) ) );
 
 	/**
 	 * Filters the YoutTube embed output.
 	 *
 	 * @since 4.0.0
diff --git a/wp-includes/version.php b/wp-includes/version.php
index a54c0193e7d..656a2009194 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-40148';
+$wp_version = '4.8-alpha-40160';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 	$embed = $wp_embed->autoembed( "https://youtube.com/watch?v={$matches[2]}" );
$wp_version = '4.8-alpha-40148';
Fixed code: 	$embed = $wp_embed->autoembed( sprintf( "https://youtube.com/watch?v=%s", urlencode( $matches[2] ) ) );
$wp_version = '4.8-alpha-40160';
CVE-2017-9062: Cross-Site Request Forgery (CSRF) (CWE-352)
value: In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.6
Published: 2017-05-18T14:29Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/class-wp-xmlrpc-server.php, wp-includes/version.php
Commit date: 2017-05-16 08:46:42 +0000
Commit message: Adjust post meta checks

Built from https://develop.svn.wordpress.org/trunk@40692


git-svn-id: http://core.svn.wordpress.org/trunk@40555 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php
index 7bbde05c2bd..9b80f0dfe1c 100644
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -380,10 +380,15 @@ class wp_xmlrpc_server extends IXR_Server {
 
 		foreach ( (array) $fields as $meta ) {
 			if ( isset($meta['id']) ) {
 				$meta['id'] = (int) $meta['id'];
 				$pmeta = get_metadata_by_mid( 'post', $meta['id'] );
+
+				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
+					continue;
+				}
+
 				if ( isset($meta['key']) ) {
 					$meta['key'] = wp_unslash( $meta['key'] );
 					if ( $meta['key'] !== $pmeta->meta_key )
 						continue;
 					$meta['value'] = wp_unslash( $meta['value'] );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 9b17c304678..616c75e1483 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-beta1-40689';
+$wp_version = '4.8-beta1-40692';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '4.8-beta1-40689';
Fixed code: 
				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
					continue;
				}

$wp_version = '4.8-beta1-40692';
CVE-2017-9062: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 8.6
Published: 2017-05-18T14:29Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/class-wp-xmlrpc-server.php, wp-includes/version.php
Commit date: 2017-05-16 08:46:42 +0000
Commit message: Adjust post meta checks

Built from https://develop.svn.wordpress.org/trunk@40692


git-svn-id: http://core.svn.wordpress.org/trunk@40555 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php
index 7bbde05c2bd..9b80f0dfe1c 100644
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -380,10 +380,15 @@ class wp_xmlrpc_server extends IXR_Server {
 
 		foreach ( (array) $fields as $meta ) {
 			if ( isset($meta['id']) ) {
 				$meta['id'] = (int) $meta['id'];
 				$pmeta = get_metadata_by_mid( 'post', $meta['id'] );
+
+				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
+					continue;
+				}
+
 				if ( isset($meta['key']) ) {
 					$meta['key'] = wp_unslash( $meta['key'] );
 					if ( $meta['key'] !== $pmeta->meta_key )
 						continue;
 					$meta['value'] = wp_unslash( $meta['value'] );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 9b17c304678..616c75e1483 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-beta1-40689';
+$wp_version = '4.8-beta1-40692';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '4.8-beta1-40689';
Fixed code: 
				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
					continue;
				}

$wp_version = '4.8-beta1-40692';
CVE-2017-9062: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 8.6
Published: 2017-05-18T14:29Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/class-wp-xmlrpc-server.php, wp-includes/version.php
Commit date: 2017-05-16 08:46:42 +0000
Commit message: Adjust post meta checks

Built from https://develop.svn.wordpress.org/trunk@40692


git-svn-id: http://core.svn.wordpress.org/trunk@40555 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php
index 7bbde05c2bd..9b80f0dfe1c 100644
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -380,10 +380,15 @@ class wp_xmlrpc_server extends IXR_Server {
 
 		foreach ( (array) $fields as $meta ) {
 			if ( isset($meta['id']) ) {
 				$meta['id'] = (int) $meta['id'];
 				$pmeta = get_metadata_by_mid( 'post', $meta['id'] );
+
+				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
+					continue;
+				}
+
 				if ( isset($meta['key']) ) {
 					$meta['key'] = wp_unslash( $meta['key'] );
 					if ( $meta['key'] !== $pmeta->meta_key )
 						continue;
 					$meta['value'] = wp_unslash( $meta['value'] );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 9b17c304678..616c75e1483 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-beta1-40689';
+$wp_version = '4.8-beta1-40692';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '4.8-beta1-40689';
Fixed code: 
				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
					continue;
				}

$wp_version = '4.8-beta1-40692';
CVE-2018-10100: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2018-04-16T09:58Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/version.php, wp-login.php
Commit date: 2018-04-03 14:32:31 +0000
Commit message: Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS.

Built from https://develop.svn.wordpress.org/trunk@42892


git-svn-id: http://core.svn.wordpress.org/trunk@42722 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/version.php b/wp-includes/version.php
index b54e649f2ce..87d92b4eb33 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.0-alpha-42891';
+$wp_version = '5.0-alpha-42892';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version
diff --git a/wp-login.php b/wp-login.php
index 93d08181ee3..e7467cb5b8d 100644
--- a/wp-login.php
+++ b/wp-login.php
@@ -12,14 +12,14 @@
 require( dirname( __FILE__ ) . '/wp-load.php' );
 
 // Redirect to https login if forced to use SSL
 if ( force_ssl_admin() && ! is_ssl() ) {
 	if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
-		wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
+		wp_safe_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
 		exit();
 	} else {
-		wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
+		wp_safe_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
 		exit();
 	}
 }
 
 /**

Vulnerable code: $wp_version = '5.0-alpha-42891';
		wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
		wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
Fixed code: $wp_version = '5.0-alpha-42892';
		wp_safe_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
		wp_safe_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
CVE-2018-10101: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2018-04-16T09:58Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/http.php, wp-includes/version.php
Commit date: 2018-04-03 15:00:31 +0000
Commit message: HTTP: Don't treat `localhost` as same host by default.

Built from https://develop.svn.wordpress.org/trunk@42894


git-svn-id: http://core.svn.wordpress.org/trunk@42724 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/http.php b/wp-includes/http.php
index bba726748ff..2b153aa1364 100644
--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -541,11 +541,11 @@ function wp_http_validate_url( $url ) {
 	}
 
 	$parsed_home = @parse_url( get_option( 'home' ) );
 
 	if ( isset( $parsed_home['host'] ) ) {
-		$same_host = ( strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] ) || 'localhost' === strtolower( $parsed_url['host'] ) );
+		$same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
 	} else {
 		$same_host = false;
 	}
 
 	if ( ! $same_host ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 4e6342a32ed..d87ff8d6fbd 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.0-alpha-42893';
+$wp_version = '5.0-alpha-42894';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 		$same_host = ( strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] ) || 'localhost' === strtolower( $parsed_url['host'] ) );
$wp_version = '5.0-alpha-42893';
Fixed code: 		$same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
$wp_version = '5.0-alpha-42894';
CVE-2019-16220: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2019-09-11T14:15Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/pluggable.php, wp-includes/version.php
Commit date: 2019-09-04 16:57:56 +0000
Commit message: Improve URL validation in `wp_validate_redirect()`.

Props vortfu, whyisjake, peterwilsoncc.
Built from https://develop.svn.wordpress.org/trunk@45971


git-svn-id: http://core.svn.wordpress.org/trunk@45782 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php
index 82b55f199a4..9336e03c7e7 100644
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -1405,10 +1405,18 @@ if ( ! function_exists( 'wp_validate_redirect' ) ) :
 		// Allow only http and https schemes. No data:, etc.
 		if ( isset( $lp['scheme'] ) && ! ( 'http' == $lp['scheme'] || 'https' == $lp['scheme'] ) ) {
 			return $default;
 		}
 
+		if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {
+			$path = '';
+			if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
+				$path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
+			}
+			$location = '/' . ltrim( $path . '/', '/' ) . $location;
+		}
+
 		// Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
 		if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {
 			return $default;
 		}
 
diff --git a/wp-includes/version.php b/wp-includes/version.php
index d31146053cc..c281d10c035 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -11,11 +11,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-alpha-45964';
+$wp_version = '5.3-alpha-45971';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '5.3-alpha-45964';
Fixed code: 		if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {
			$path = '';
			if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
				$path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
			}
			$location = '/' . ltrim( $path . '/', '/' ) . $location;
		}

$wp_version = '5.3-alpha-45971';
CVE-2019-16222: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-09-11T14:15Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/kses.php, wp-includes/version.php
Commit date: 2019-09-04 17:52:56 +0000
Commit message: Fix for URL sanitization that can lead to cross-site scripting (XSS) attacks.

Props irsdl, sstoqnov, whyisjake.
Built from https://develop.svn.wordpress.org/trunk@45997


git-svn-id: http://core.svn.wordpress.org/trunk@45808 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/kses.php b/wp-includes/kses.php
index b707dca8139..79759493706 100644
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -1662,10 +1662,11 @@ function wp_kses_html_error( $string ) {
  * @param string   $string            Content to check for bad protocols.
  * @param string[] $allowed_protocols Array of allowed URL protocols.
  * @return string Sanitized content.
  */
 function wp_kses_bad_protocol_once( $string, $allowed_protocols, $count = 1 ) {
+	$string  = preg_replace( '/(&#0*58(?![;0-9])|&#x0*3a(?![;a-f0-9]))/i', '$1;', $string );
 	$string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );
 	if ( isset( $string2[1] ) && ! preg_match( '%/\?%', $string2[0] ) ) {
 		$string   = trim( $string2[1] );
 		$protocol = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols );
 		if ( 'feed:' == $protocol ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index f0c3f56b0d9..b4e1f225caa 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -11,11 +11,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-alpha-45990';
+$wp_version = '5.3-alpha-45997';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '5.3-alpha-45990';
Fixed code: 	$string  = preg_replace( '/(&#0*58(?![;0-9])|&#x0*3a(?![;a-f0-9]))/i', '$1;', $string );
$wp_version = '5.3-alpha-45997';
CVE-2019-17669: Server-Side Request Forgery (SSRF) (CWE-918)
value: WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.8
Published: 2019-10-17T13:15Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/http.php, wp-includes/version.php
Commit date: 2019-10-14 15:27:04 +0000
Commit message: HTTP API: Protect against hex interpretation.

Return earlier from wp_http_validate_url().

Props: iandunn, xknown, voldemortensen, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46475


git-svn-id: http://core.svn.wordpress.org/trunk@46273 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/http.php b/wp-includes/http.php
index 36922da60e2..3356b971629 100644
--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -548,11 +548,11 @@ function wp_http_validate_url( $url ) {
 		if ( preg_match( '#^(([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)\.){3}([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)$#', $host ) ) {
 			$ip = $host;
 		} else {
 			$ip = gethostbyname( $host );
 			if ( $ip === $host ) { // Error condition for gethostbyname()
-				$ip = false;
+				return false;
 			}
 		}
 		if ( $ip ) {
 			$parts = array_map( 'intval', explode( '.', $ip ) );
 			if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
diff --git a/wp-includes/version.php b/wp-includes/version.php
index a4f93bdb27f..8805c87052d 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -11,11 +11,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-beta3-46474';
+$wp_version = '5.3-beta3-46475';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 				$ip = false;
$wp_version = '5.3-beta3-46474';
Fixed code: 				return false;
$wp_version = '5.3-beta3-46475';