Description: Remove XSS from TinyMCE
 Fixes a cross-site scripting (XSS) vulnerability in the visual editor.
 CVE-2017-14726
 https://core.trac.wordpress.org/changeset/41442/branches/4.1
Author: ocean90@wordpress.org
Origin: upstream, https://core.trac.wordpress.org/changeset/41436/branches/4.7
Bug-Debian: https://bugs.debian.org/876274
Applied-Upstream: 4.8.2
Reviewed-by: Craig Small <csmall@debian.org>
Last-Update: 2017-09-23
--- a/wp-includes/js/mce-view.js
+++ b/wp-includes/js/mce-view.js
@@ -131,6 +131,14 @@
 				importStyles = this.type === 'video' || this.type === 'audio' || this.type === 'playlist';
 
 			if ( head || body.indexOf( '<script' ) !== -1 ) {
+				if ( body.indexOf( '[' ) !== -1 && body.indexOf( ']' ) !== -1 ) {
+					var shortcodesRegExp = new RegExp( '\\[\\/?(?:' + window.mceViewL10n.shortcodes.join( '|' ) + ')[^\\]]*?\\]', 'g' );
+					// Escape tags inside shortcode previews.
+					body = body.replace( shortcodesRegExp, function( match ) {
+						return match.replace( /</g, '&lt;' ).replace( />/g, '&gt;' );
+					} );
+				}
+
 				this.getNodes( function ( editor, node, content ) {
 					var dom = editor.dom,
 						styles = '',
--- a/wp-includes/script-loader.php
+++ b/wp-includes/script-loader.php
@@ -706,6 +706,9 @@
 		'blog_id' => get_current_blog_id(),
 	) );
 
+	wp_localize_script( 'mce-view', 'mceViewL10n', array(
+		'shortcodes' => ! empty( $GLOBALS['shortcode_tags'] ) ? array_keys( $GLOBALS['shortcode_tags'] ) : array()
+	) );
 }
 
 /**
