From 1b675c6e4abf4341c9f9efeee0b446acc979ec7f Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Sat, 14 Dec 2019 15:53:06 +0000
Subject: [PATCH] Formatting: Return early from `wp_kses_attr_check()` if the
 element is not in the list of allowed elements and attributes.

Props krynes, tristanleboss.
Fixes #48549.
Built from https://develop.svn.wordpress.org/trunk@46959


git-svn-id: http://core.svn.wordpress.org/trunk@46759 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/kses.php    | 13 +++++++++++--
 wp-includes/version.php |  2 +-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/wp-includes/kses.php b/wp-includes/kses.php
index bc8db94995..179aaebd5b 100644
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -1152,9 +1152,18 @@ function wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) {
  * @return bool Whether or not the attribute is allowed.
  */
 function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
-	$allowed_attr = $allowed_html[ strtolower( $element ) ];
+	$name_low    = strtolower( $name );
+	$element_low = strtolower( $element );
+
+	if ( ! isset( $allowed_html[ $element_low ] ) ) {
+		$name  = '';
+		$value = '';
+		$whole = '';
+		return false;
+	}
+
+	$allowed_attr = $allowed_html[ $element_low ];
 
-	$name_low = strtolower( $name );
 	if ( ! isset( $allowed_attr[ $name_low ] ) || '' == $allowed_attr[ $name_low ] ) {
 		/*
 		 * Allow `data-*` attributes.
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 73c0af47ab..15bab24d04 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.4-alpha-46958';
+$wp_version = '5.4-alpha-46959';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.