diff --git a/src/wp-includes/kses.php b/src/wp-includes/kses.php index 7928f6d57a..157be6be11 100644 --- a/src/wp-includes/kses.php +++ b/src/wp-includes/kses.php @@ -1686,7 +1686,16 @@ function wp_kses_check_attr_val( $value, $vless, $checkname, $checkvalue ) { * @return string Filtered content. */ function wp_kses_bad_protocol( $content, $allowed_protocols ) { - $content = wp_kses_no_null( $content ); + $content = wp_kses_no_null( $content ); + + // Short-circuit if the string starts with `https://` or `http://`. Most common cases. + if ( + ( str_starts_with( $content, 'https://' ) && in_array( 'https', $allowed_protocols, true ) ) || + ( str_starts_with( $content, 'http://' ) && in_array( 'http', $allowed_protocols, true ) ) + ) { + return $content; + } + $iterations = 0; do {