From f9a6a7aa565a6e555ea8439b076134363bd66a91 Mon Sep 17 00:00:00 2001
From: Andrew Ozz <azaozz@git.wordpress.org>
Date: Wed, 4 Mar 2015 19:28:53 +0000
Subject: [PATCH] PressThis: - Improve handling of the data, both from the
 bookmarklet and from server-side parsing. - Standardize on processing the
 data in PHP and remove duplicate code from JS. - Improve the bookmarklet code
 and remove pre-filtering of the data. Part props stephdau, see #31373.

git-svn-id: https://develop.svn.wordpress.org/trunk@31609 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/includes/class-wp-press-this.php | 364 +++++++++++++-----
 src/wp-admin/js/bookmarklet.js                |  49 +--
 src/wp-admin/js/bookmarklet.min.js            |   2 +-
 src/wp-admin/js/press-this.js                 | 124 +-----
 src/wp-includes/link-template.php             |   2 +-
 5 files changed, 293 insertions(+), 248 deletions(-)

diff --git a/src/wp-admin/includes/class-wp-press-this.php b/src/wp-admin/includes/class-wp-press-this.php
index 3ea927d3d2..0865f6ac70 100644
--- a/src/wp-admin/includes/class-wp-press-this.php
+++ b/src/wp-admin/includes/class-wp-press-this.php
@@ -40,7 +40,7 @@ class WP_Press_This {
 		return array(
 			// Used to trigger the bookmarklet update notice.
 			// Needs to be set here and in get_shortcut_link() in wp-includes/link-template.php.
-			'version' => '5',
+			'version' => '6',
 
 			/**
 			 * Filter whether or not Press This should redirect the user in the parent window upon save.
@@ -278,7 +278,7 @@ class WP_Press_This {
 	 */
 	public function fetch_source_html( $url ) {
 		// Download source page to tmp file.
-		$source_tmp_file = ( ! empty( $url ) ) ? download_url( $url ) : '';
+		$source_tmp_file = ( ! empty( $url ) ) ? download_url( $url, 30 ) : '';
 		$source_content  = '';
 
 		if ( ! is_wp_error( $source_tmp_file ) && file_exists( $source_tmp_file ) ) {
@@ -318,6 +318,162 @@ class WP_Press_This {
 		return $source_content;
 	}
 
+	private function _limit_array( $value ) {
+		if ( is_array( $value ) ) {
+			if ( count( $value ) > 50 ) {
+				return array_slice( $value, 0, 50 );
+			}
+
+			return $value;
+		}
+
+		return array();
+	}
+
+	private function _limit_string( $value ) {
+		$return = '';
+
+		if ( is_numeric( $value ) || is_bool( $value ) ) {
+			$return = (string) $value;
+		} else if ( is_string( $value ) ) {
+			if ( mb_strlen( $value ) > 5000 ) {
+				$return = mb_substr( $value, 0, 5000 );
+			} else {
+				$return = $value;
+			}
+
+			$return = html_entity_decode( $return, ENT_QUOTES, 'UTF-8' );
+			$return = sanitize_text_field( trim( $return ) );
+		}
+
+		return $return;
+	}
+
+	private function _limit_url( $url ) {
+		if ( ! is_string( $url ) ) {
+			return '';
+		}
+		
+		$url = $this->_limit_string( $url );
+
+		// HTTP 1.1 allows 8000 chars but the "de-facto" standard supported in all current browsers is 2048.
+		if ( mb_strlen( $url ) > 2048 ) {
+			return ''; // Return empty rather than a trunacted/invalid URL
+		}
+
+		// Only allow http(s) or protocol relative URLs.
+		if ( ! preg_match( '%^(https?:)?//%i', $url ) ) {
+			return '';
+		}
+
+		if ( strpos( $url, '"' ) !== false || strpos( $url, ' ' ) !== false ) {
+			return '';
+		}
+
+		return $url;
+	}
+
+	private function _limit_img( $src ) {
+		$src = $this->_limit_url( $src );
+
+		if ( preg_match( '/\/ad[sx]{1}?\//', $src ) ) {
+			// Ads
+			return '';
+		} else if ( preg_match( '/(\/share-?this[^\.]+?\.[a-z0-9]{3,4})(\?.*)?$/', $src ) ) {
+			// Share-this type button
+			return '';
+		} else if ( preg_match( '/\/(spinner|loading|spacer|blank|rss)\.(gif|jpg|png)/', $src ) ) {
+			// Loaders, spinners, spacers
+			return '';
+		} else if ( preg_match( '/\/([^\.\/]+[-_]{1})?(spinner|loading|spacer|blank)s?([-_]{1}[^\.\/]+)?\.[a-z0-9]{3,4}/', $src ) ) {
+			// Fancy loaders, spinners, spacers
+			return '';
+		} else if ( preg_match( '/([^\.\/]+[-_]{1})?thumb[^.]*\.(gif|jpg|png)$/', $src ) ) {
+			// Thumbnails, too small, usually irrelevant to context
+			return '';
+		} else if ( preg_match( '/\/wp-includes\//', $src ) ) {
+			// Classic WP interface images
+			return '';
+		} else if ( preg_match( '/[^\d]{1}\d{1,2}x\d+\.(gif|jpg|png)$/', $src ) ) {
+			// Most often tiny buttons/thumbs (< 100px wide)
+			return '';
+		} else if ( preg_match( '/\/pixel\.(mathtag|quantserve)\.com/', $src ) ) {
+			// See mathtag.com and https://www.quantcast.com/how-we-do-it/iab-standard-measurement/how-we-collect-data/
+			return '';
+		} else if ( false !== strpos( $src, '/g.gif' ) ) {
+			// Classic WP stats gif
+			return '';
+		}
+
+		return $src;
+	}
+
+	private function _limit_embed( $src ) {
+		$src = $this->_limit_url( $src );
+
+		if ( preg_match( '/\/\/www\.youtube\.com\/(embed|v)\/([^\?]+)\?.+$/', $src, $src_matches ) ) {
+			$src = 'https://www.youtube.com/watch?v=' . $src_matches[2];
+		} else if ( preg_match( '/\/\/player\.vimeo\.com\/video\/([\d]+)([\?\/]{1}.*)?$/', $src, $src_matches ) ) {
+			$src = 'https://vimeo.com/' . (int) $src_matches[1];
+		} else if ( preg_match( '/\/\/vimeo\.com\/moogaloop\.swf\?clip_id=([\d]+)$/', $src, $src_matches ) ) {
+			$src = 'https://vimeo.com/' . (int) $src_matches[1];
+		} else if ( preg_match( '/\/\/vine\.co\/v\/([^\/]+)\/embed/', $src, $src_matches ) ) {
+			$src = 'https://vine.co/v/' . $src_matches[1];
+		} else if ( ! preg_match( '/\/\/(m\.|www\.)?youtube\.com\/watch\?/', $src )
+		            && ! preg_match( '/\/youtu\.be\/.+$/', $src )
+		            && ! preg_match( '/\/\/vimeo\.com\/[\d]+$/', $src )
+		            && ! preg_match( '/\/\/(www\.)?dailymotion\.com\/video\/.+$/', $src )
+		            && ! preg_match( '/\/\/soundcloud\.com\/.+$/', $src )
+		            && ! preg_match( '/\/\/twitter\.com\/[^\/]+\/status\/[\d]+$/', $src )
+		            && ! preg_match( '/\/\/vine\.co\/v\/[^\/]+/', $src ) ) {
+			$src = '';
+		}
+
+		return $src;
+	}
+
+	private function _process_meta_entry( $meta_name, $meta_value, $data ) {
+		if ( preg_match( '/:?(title|description|keywords)$/', $meta_name ) ) {
+			$data['_meta'][ $meta_name ] = $meta_value;
+		} else {
+			switch ( $meta_name ) {
+				case 'og:url':
+				case 'og:video':
+				case 'og:video:secure_url':
+					$meta_value = $this->_limit_embed( $meta_value );
+
+					if ( ! isset( $data['_embed'] ) ) {
+						$data['_embed'] = array();
+					}
+
+					if ( ! empty( $meta_value ) && ! in_array( $meta_value, $data['_embed'] ) ) {
+						$data['_embed'][] = $meta_value;
+					}
+
+					break;
+				case 'og:image':
+				case 'og:image:secure_url':
+				case 'twitter:image0:src':
+				case 'twitter:image0':
+				case 'twitter:image:src':
+				case 'twitter:image':
+					$meta_value = $this->_limit_img( $meta_value );
+
+					if ( ! isset( $data['_img'] ) ) {
+						$data['_img'] = array();
+					}
+
+					if ( ! empty( $meta_value ) && ! in_array( $meta_value, $data['_img'] ) ) {
+						$data['_img'][] = $meta_value;
+					}
+
+					break;
+			}
+		}
+		
+		return $data;
+	}
+
 	/**
 	 * Fetches and parses _meta, _img, and _links data from the source.
 	 *
@@ -339,18 +495,42 @@ class WP_Press_This {
 			return array( 'errors' => $source_content->get_error_messages() );
 		}
 
+		// Fetch and gather <meta> data first, so discovered media is offered 1st to user.
+		if ( empty( $data['_meta'] ) ) {
+			$data['_meta'] = array();
+		}
+
+		if ( preg_match_all( '/<meta [^>]+>/', $source_content, $matches ) ) {
+			$items = $this->_limit_array( $matches[0] );
+
+			foreach ( $items as $value ) {
+				if ( preg_match( '/(property|name)="([^"]+)"[^>]+content="([^"]+)"/', $value, $new_matches ) ) {
+					$meta_name  = $this->_limit_string( $new_matches[2] );
+					$meta_value = $this->_limit_string( $new_matches[3] );
+
+					// Sanity check. $key is usually things like 'title', 'description', 'keywords', etc.
+					if ( strlen( $meta_name ) > 100 ) {
+						continue;
+					}
+
+					$data = $this->_process_meta_entry( $meta_name, $meta_value, $data );
+				}
+			}
+		}
+
 		// Fetch and gather <img> data.
 		if ( empty( $data['_img'] ) ) {
 			$data['_img'] = array();
 		}
 
-		if ( preg_match_all( '/<img (.+)[\s]?\/>/', $source_content, $matches ) ) {
-			if ( ! empty( $matches[0] ) ) {
-				foreach ( $matches[0] as $value ) {
-					if ( preg_match( '/<img[^>]+src="([^"]+)"[^>]+\/>/', $value, $new_matches ) ) {
-						if ( ! in_array( $new_matches[1], $data['_img'] ) ) {
-							$data['_img'][] = $new_matches[1];
-						}
+		if ( preg_match_all( '/<img [^>]+>/', $source_content, $matches ) ) {
+			$items = $this->_limit_array( $matches[0] );
+
+			foreach ( $items as $value ) {
+				if ( preg_match( '/src=(\'|")([^\'"]+)\\1/', $value, $new_matches ) ) {
+					$src = $this->_limit_img( $new_matches[2] );
+					if ( ! empty( $src ) && ! in_array( $src, $data['_img'] ) ) {
+						$data['_img'][] = $src;
 					}
 				}
 			}
@@ -361,66 +541,15 @@ class WP_Press_This {
 			$data['_embed'] = array();
 		}
 
-		if ( preg_match_all( '/<iframe (.+)[\s][^>]*>/', $source_content, $matches ) ) {
-			if ( ! empty( $matches[0] ) ) {
-				foreach ( $matches[0] as $value ) {
-					if ( preg_match( '/<iframe[^>]+src=(\'|")([^"]+)(\'|")/', $value, $new_matches ) ) {
-						if ( ! in_array( $new_matches[2], $data['_embed'] ) ) {
-							if ( preg_match( '/\/\/www\.youtube\.com\/embed\/([^\?]+)\?.+$/', $new_matches[2], $src_matches ) ) {
-								$data['_embed'][] = 'https://www.youtube.com/watch?v=' . $src_matches[1];
-							} else if ( preg_match( '/\/\/player\.vimeo\.com\/video\/([\d]+)([\?\/]{1}.*)?$/', $new_matches[2], $src_matches ) ) {
-								$data['_embed'][] = 'https://vimeo.com/' . (int) $src_matches[1];
-							} else if ( preg_match( '/\/\/vine\.co\/v\/([^\/]+)\/embed/', $new_matches[2], $src_matches ) ) {
-								$data['_embed'][] = 'https://vine.co/v/' . $src_matches[1];
-							}
-						}
-					}
-				}
-			}
-		}
+		if ( preg_match_all( '/<iframe [^>]+>/', $source_content, $matches ) ) {
+			$items = $this->_limit_array( $matches[0] );
 
-		// Fetch and gather <meta> data.
-		if ( empty( $data['_meta'] ) ) {
-			$data['_meta'] = array();
-		}
+			foreach ( $items as $value ) {
+				if ( preg_match( '/src=(\'|")([^\'"]+)\\1/', $value, $new_matches ) ) {
+					$src = $this->_limit_embed( $new_matches[2] );
 
-		if ( preg_match_all( '/<meta ([^>]+)[\s]?\/?>/', $source_content, $matches ) ) {
-			if ( ! empty( $matches[0] ) ) {
-				foreach ( $matches[0] as $key => $value ) {
-					if ( preg_match( '/<meta[^>]+(property|name)="(.+)"[^>]+content="(.+)"/', $value, $new_matches ) ) {
-						if ( empty( $data['_meta'][ $new_matches[2] ] ) ) {
-							if ( preg_match( '/:?(title|description|keywords)$/', $new_matches[2] ) ) {
-								$data['_meta'][ $new_matches[2] ] = str_replace( '&#039;', "'", str_replace( '&#034;', '', html_entity_decode( $new_matches[3] ) ) );
-							} else {
-								$data['_meta'][ $new_matches[2] ] = $new_matches[3];
-								if ( 'og:url' == $new_matches[2] ) {
-									if ( false !== strpos( $new_matches[3], '//www.youtube.com/watch?' )
-									     || false !== strpos( $new_matches[3], '//www.dailymotion.com/video/' )
-									     || preg_match( '/\/\/vimeo\.com\/[\d]+$/', $new_matches[3] )
-									     || preg_match( '/\/\/soundcloud\.com\/.+$/', $new_matches[3] )
-									     || preg_match( '/\/\/twitter\.com\/[^\/]+\/status\/[\d]+$/', $new_matches[3] )
-									     || preg_match( '/\/\/vine\.co\/v\/[^\/]+/', $new_matches[3] ) ) {
-										if ( ! in_array( $new_matches[3], $data['_embed'] ) ) {
-											$data['_embed'][] = $new_matches[3];
-										}
-									}
-								} else if ( 'og:video' == $new_matches[2] || 'og:video:secure_url' == $new_matches[2] ) {
-									if ( preg_match( '/\/\/www\.youtube\.com\/v\/([^\?]+)/', $new_matches[3], $src_matches ) ) {
-										if ( ! in_array( 'https://www.youtube.com/watch?v=' . $src_matches[1], $data['_embed'] ) ) {
-											$data['_embed'][] = 'https://www.youtube.com/watch?v=' . $src_matches[1];
-										}
-									} else if ( preg_match( '/\/\/vimeo.com\/moogaloop\.swf\?clip_id=([\d]+)$/', $new_matches[3], $src_matches ) ) {
-										if ( ! in_array( 'https://vimeo.com/' . $src_matches[1], $data['_embed'] ) ) {
-											$data['_embed'][] = 'https://vimeo.com/' . $src_matches[1];
-										}
-									}
-								} else if ( 'og:image' == $new_matches[2] || 'og:image:secure_url' == $new_matches[2] ) {
-									if ( ! in_array( $new_matches[3], $data['_img'] ) ) {
-										$data['_img'][] = $new_matches[3];
-									}
-								}
-							}
-						}
+					if ( ! empty( $src ) && ! in_array( $src, $data['_embed'] ) ) {
+						$data['_embed'][] = $src;
 					}
 				}
 			}
@@ -431,14 +560,16 @@ class WP_Press_This {
 			$data['_links'] = array();
 		}
 
-		if ( preg_match_all( '/<link ([^>]+)[\s]?\/>/', $source_content, $matches ) ) {
-			if ( ! empty( $matches[0] ) ) {
-				foreach ( $matches[0] as $key => $value ) {
-					if ( preg_match( '/<link[^>]+(rel|itemprop)="([^"]+)"[^>]+href="([^"]+)"[^>]+\/>/', $value, $new_matches ) ) {
-						if ( 'alternate' == $new_matches[2] || 'thumbnailUrl' == $new_matches[2] || 'url' == $new_matches[2] ) {
-							if ( empty( $data['_links'][ $new_matches[2] ] ) ) {
-								$data['_links'][ $new_matches[2] ] = $new_matches[3];
-							}
+		if ( preg_match_all( '/<link [^>]+>/', $source_content, $matches ) ) {
+			$items = $this->_limit_array( $matches[0] );
+
+			foreach ( $items as $value ) {
+				if ( preg_match( '/(rel|itemprop)="([^"]+)"[^>]+href="([^"]+)"/', $value, $new_matches ) ) {
+					if ( 'alternate' === $new_matches[2] || 'thumbnailUrl' === $new_matches[2] || 'url' === $new_matches[2] ) {
+						$url = $this->_limit_url( $new_matches[3] );
+
+						if ( ! empty( $url ) && empty( $data['_links'][ $new_matches[2] ] ) ) {
+							$data['_links'][ $new_matches[2] ] = $url;
 						}
 					}
 				}
@@ -457,13 +588,29 @@ class WP_Press_This {
 	 * @return array
 	 */
 	public function merge_or_fetch_data() {
-		// Merge $_POST and $_GET, as appropriate ($_POST > $_GET), to remain backward compatible.
-		$data = array_merge_recursive( $_POST, $_GET );
+		// Get data from $_POST and $_GET, as appropriate ($_POST > $_GET), to remain backward compatible.
+		$data = array();
 
-		// Get the legacy QS params, or equiv POST data
-		$data['u'] = ( ! empty( $data['u'] ) && preg_match( '/^https?:/', $data['u'] ) ) ? $data['u'] : '';
-		$data['s'] = ( ! empty( $data['s'] ) ) ? $data['s'] : '';
-		$data['t'] = ( ! empty( $data['t'] ) ) ? $data['t'] : '';
+		// Only instantiate the keys we want. Sanity check and sanitize each one.
+		foreach ( array( 'u', 's', 't', 'v', '_version' ) as $key ) {
+			if ( ! empty( $_POST[ $key ] ) ) {
+				$value = wp_unslash( $_POST[ $key ] );
+			} else if ( ! empty( $_GET[ $key ] ) ) {
+				$value = wp_unslash( $_GET[ $key ] );
+			} else {
+				continue;
+			}
+
+			if ( 'u' === $key ) {
+				$value = $this->_limit_url( $value );
+			} else {
+				$value = $this->_limit_string( $value );
+			}
+
+			if ( ! empty( $value ) ) {
+				$data[ $key ] = $value;
+			}
+		}
 
 		/**
 		 * Filter whether to enable in-source media discovery in Press This.
@@ -474,21 +621,50 @@ class WP_Press_This {
 		 */
 		if ( apply_filters( 'enable_press_this_media_discovery', true ) ) {
 			/*
-			 * If no _meta (a new thing) was passed via $_POST, fetch data from source as fallback,
-			 * makes PT fully backward compatible
+			 * If no title, _img, _embed, and _meta was passed via $_POST, fetch data from source as fallback,
+			 * making PT fully backward compatible with the older bookmarklet.
 			 */
-			if ( empty( $data['_meta'] ) && ! empty( $data['u'] ) ) {
+			if ( empty( $_POST ) && ! empty( $data['u'] ) ) {
 				$data = $this->source_data_fetch_fallback( $data['u'], $data );
-			}
-		} else {
-			if ( ! empty( $data['_img'] ) ) {
-				$data['_img'] = array();
-			}
-			if ( ! empty( $data['_embed'] ) ) {
-				$data['_embed'] = array();
-			}
-			if ( ! empty( $data['_meta'] ) ) {
-				$data['_meta'] = array();
+			} else {
+				foreach ( array( '_img', '_embed', '_meta' ) as $type ) {
+					if ( empty( $_POST[ $type ] ) ) {
+						continue;
+					}
+
+					$data[ $type ] = array();
+					$items = $this->_limit_array( $_POST[ $type ] );
+					$items = wp_unslash( $items );
+
+					foreach ( $items as $key => $value ) {
+						$key = $this->_limit_string( wp_unslash( $key ) );
+
+						// Sanity check. $key is usually things like 'title', 'description', 'keywords', etc.
+						if ( empty( $key ) || strlen( $key ) > 100 ) {
+							continue;
+						}
+
+						if ( $type === '_meta' ) {
+							$value = $this->_limit_string( $value );
+
+							if ( ! empty( $value ) ) {
+								$data = $this->_process_meta_entry( $key, $value, $data );
+							}
+						} else if ( $type === '_img' ) {
+							$value = $this->_limit_img( $value );
+
+							if ( ! empty( $value ) ) {
+								$data[ $type ][] = $value;
+							}
+						} else if ( $type === '_embed' ) {
+							$value = $this->_limit_embed( $value );
+
+							if ( ! empty( $value ) ) {
+								$data[ $type ][] = $value;
+							}
+						}
+					}
+				}
 			}
 		}
 
diff --git a/src/wp-admin/js/bookmarklet.js b/src/wp-admin/js/bookmarklet.js
index 0cedee1e5e..2deee86c52 100644
--- a/src/wp-admin/js/bookmarklet.js
+++ b/src/wp-admin/js/bookmarklet.js
@@ -7,7 +7,7 @@
 		canPost = true,
 		windowWidth, windowHeight,
 		metas, links, content, imgs, ifrs,
-		vid, selection, newWin;
+		selection;
 
 	if ( ! pt_url ) {
 		return;
@@ -28,17 +28,19 @@
 	} else if ( document.getSelection ) {
 		selection = document.getSelection() + '';
 	} else if ( document.selection ) {
-		selection = document.selection.createRange().text;
+		selection = document.selection.createRange().text || '';
 	}
 
 	pt_url += ( pt_url.indexOf( '?' ) > -1 ? '&' : '?' ) + 'buster=' + ( new Date().getTime() );
 
-	if ( document.title.length && ( document.title.length <= 256 || ! canPost ) ) {
-		pt_url += '&t=' + encURI( document.title.substr( 0, 256 ) );
-	}
+	if ( ! canPost ) {
+		if ( document.title ) {
+			pt_url += '&t=' + encURI( document.title.substr( 0, 256 ) );
+		}
 
-	if ( selection && ( selection.length <= 512 || ! canPost ) ) {
-		pt_url += '&s=' + encURI( selection.substr( 0, 512 ) );
+		if ( selection ) {
+			pt_url += '&s=' + encURI( selection.substr( 0, 512 ) );
+		}
 	}
 
 	windowWidth  = window.outerWidth || document.documentElement.clientWidth || 600;
@@ -48,8 +50,7 @@
 	windowHeight = ( windowHeight < 800 || windowHeight > 3000 ) ? 700 : ( windowHeight * 0.9 );
 
 	if ( ! canPost ) {
-		newWin = window.open( pt_url, target, 'location,resizable,scrollbars,width=' + windowWidth + ',height=' + windowHeight );
-		newWin.focus();
+		window.open( pt_url, target, 'location,resizable,scrollbars,width=' + windowWidth + ',height=' + windowHeight );
 		return;
 	}
 
@@ -135,7 +136,7 @@
 	imgs = content.getElementsByTagName( 'img' ) || [];
 
 	for ( var n = 0; n < imgs.length; n++ ) {
-		if ( n >= 100 ) {
+		if ( n >= 50 ) {
 			break;
 		}
 
@@ -153,34 +154,18 @@
 	ifrs = document.body.getElementsByTagName( 'iframe' ) || [];
 
 	for ( var p = 0; p < ifrs.length; p++ ) {
-		if ( p >= 100 ) {
+		if ( p >= 50 ) {
 			break;
 		}
 
-		vid = ifrs[ p ].src.match(/\/\/www\.youtube\.com\/embed\/([^\?]+)\?.+$/);
-
-		if ( vid && 2 === vid.length ) {
-			add( '_embed[]', 'https://www.youtube.com/watch?v=' + vid[1] );
-		}
-
-		vid = ifrs[ p ].src.match( /\/\/player\.vimeo\.com\/video\/([\d]+)$/ );
-
-		if ( vid && 2 === vid.length ) {
-			add( '_embed[]', 'https://vimeo.com/' + vid[1] );
-		}
-
-		vid = ifrs[ p ].src.match( /\/\/vine\.co\/v\/([^\/]+)\/embed/ );
-
-		if ( vid && 2 === vid.length ) {
-			add( '_embed[]', 'https://vine.co/v/' + vid[1] );
-		}
+		add( '_embed[]', ifrs[ p ].src );
 	}
 
-	if ( document.title && document.title > 512 ) {
+	if ( document.title ) {
 		add( 't', document.title );
 	}
 
-	if ( selection && selection.length > 512 ) {
+	if ( selection ) {
 		add( 's', selection );
 	}
 
@@ -189,10 +174,8 @@
 	form.setAttribute( 'target', target );
 	form.setAttribute( 'style', 'display: none;' );
 
-	newWin = window.open( 'about:blank', target, 'location,resizable,scrollbars,width=' + windowWidth + ',height=' + windowHeight );
+	window.open( 'about:blank', target, 'location,resizable,scrollbars,width=' + windowWidth + ',height=' + windowHeight );
 
 	document.body.appendChild( form );
 	form.submit();
-
-	newWin.focus();
 } )( window, document, top.location.href, window.pt_url );
diff --git a/src/wp-admin/js/bookmarklet.min.js b/src/wp-admin/js/bookmarklet.min.js
index 080939f9e7..5aa2934e50 100644
--- a/src/wp-admin/js/bookmarklet.min.js
+++ b/src/wp-admin/js/bookmarklet.min.js
@@ -1 +1 @@
-(function(a,b,c,d){function e(a,c){if("undefined"!=typeof c){var d=b.createElement("input");d.name=a,d.value=c,d.type="hidden",q.appendChild(d)}}var f,g,h,i,j,k,l,m,n,o,p=a.encodeURIComponent,q=b.createElement("form"),r=b.getElementsByTagName("head")[0],s=new Image,t="_press_this_app",u=!0;if(d){if(!c.match(/^https?:/))return void(top.location.href=d);if(d+="&u="+p(c),c.match(/^https:/)&&d.match(/^http:/)&&(u=!1),a.getSelection?n=a.getSelection()+"":b.getSelection?n=b.getSelection()+"":b.selection&&(n=b.selection.createRange().text),d+=(d.indexOf("?")>-1?"&":"?")+"buster="+(new Date).getTime(),b.title.length&&(b.title.length<=256||!u)&&(d+="&t="+p(b.title.substr(0,256))),n&&(n.length<=512||!u)&&(d+="&s="+p(n.substr(0,512))),f=a.outerWidth||b.documentElement.clientWidth||600,g=a.outerHeight||b.documentElement.clientHeight||700,f=800>f||f>5e3?600:.7*f,g=800>g||g>3e3?700:.9*g,!u)return o=a.open(d,t,"location,resizable,scrollbars,width="+f+",height="+g),void o.focus();c.match(/\/\/www\.youtube\.com\/watch/)?e("_embed[]",c):c.match(/\/\/vimeo\.com\/(.+\/)?([\d]+)$/)?e("_embed[]",c):c.match(/\/\/(www\.)?dailymotion\.com\/video\/.+$/)?e("_embed[]",c):c.match(/\/\/soundcloud\.com\/.+$/)?e("_embed[]",c):c.match(/\/\/twitter\.com\/[^\/]+\/status\/[\d]+$/)?e("_embed[]",c):c.match(/\/\/vine\.co\/v\/[^\/]+/)&&e("_embed[]",c),h=r.getElementsByTagName("meta")||[];for(var v=0;v<h.length&&!(v>=50);v++){var w=h[v],x=w.getAttribute("name"),y=w.getAttribute("property"),z=w.getAttribute("content");x?e("_meta["+x+"]",z):y&&e("_meta["+y+"]",z)}i=r.getElementsByTagName("link")||[];for(var A=0;A<i.length&&!(A>=50);A++){var B=i[A],C=B.getAttribute("rel");if(C)switch(C){case"canonical":case"icon":case"shortlink":e("_links["+C+"]",B.getAttribute("href"));break;case"alternate":"application/json+oembed"===B.getAttribute("type")?e("_links["+C+"]",B.getAttribute("href")):"handheld"===B.getAttribute("media")&&e("_links["+C+"]",B.getAttribute("href"))}}b.body.getElementsByClassName&&(j=b.body.getElementsByClassName("hfeed")[0]),j=b.getElementById("content")||j||b.body,k=j.getElementsByTagName("img")||[];for(var D=0;D<k.length&&!(D>=100);D++)k[D].src.indexOf("avatar")>-1||k[D].className.indexOf("avatar")>-1||(s.src=k[D].src,s.width>=256&&s.height>=128&&e("_img[]",s.src));l=b.body.getElementsByTagName("iframe")||[];for(var E=0;E<l.length&&!(E>=100);E++)m=l[E].src.match(/\/\/www\.youtube\.com\/embed\/([^\?]+)\?.+$/),m&&2===m.length&&e("_embed[]","https://www.youtube.com/watch?v="+m[1]),m=l[E].src.match(/\/\/player\.vimeo\.com\/video\/([\d]+)$/),m&&2===m.length&&e("_embed[]","https://vimeo.com/"+m[1]),m=l[E].src.match(/\/\/vine\.co\/v\/([^\/]+)\/embed/),m&&2===m.length&&e("_embed[]","https://vine.co/v/"+m[1]);b.title&&b.title>512&&e("t",b.title),n&&n.length>512&&e("s",n),q.setAttribute("method","POST"),q.setAttribute("action",d),q.setAttribute("target",t),q.setAttribute("style","display: none;"),o=a.open("about:blank",t,"location,resizable,scrollbars,width="+f+",height="+g),b.body.appendChild(q),q.submit(),o.focus()}})(window,document,top.location.href,window.pt_url);
\ No newline at end of file
+(function(a,b,c,d){function e(a,c){if("undefined"!=typeof c){var d=b.createElement("input");d.name=a,d.value=c,d.type="hidden",o.appendChild(d)}}var f,g,h,i,j,k,l,m,n=a.encodeURIComponent,o=b.createElement("form"),p=b.getElementsByTagName("head")[0],q=new Image,r="_press_this_app",s=!0;if(d){if(!c.match(/^https?:/))return void(top.location.href=d);if(d+="&u="+n(c),c.match(/^https:/)&&d.match(/^http:/)&&(s=!1),a.getSelection?m=a.getSelection()+"":b.getSelection?m=b.getSelection()+"":b.selection&&(m=b.selection.createRange().text||""),d+=(d.indexOf("?")>-1?"&":"?")+"buster="+(new Date).getTime(),s||(b.title&&(d+="&t="+n(b.title.substr(0,256))),m&&(d+="&s="+n(m.substr(0,512)))),f=a.outerWidth||b.documentElement.clientWidth||600,g=a.outerHeight||b.documentElement.clientHeight||700,f=800>f||f>5e3?600:.7*f,g=800>g||g>3e3?700:.9*g,!s)return void a.open(d,r,"location,resizable,scrollbars,width="+f+",height="+g);c.match(/\/\/www\.youtube\.com\/watch/)?e("_embed[]",c):c.match(/\/\/vimeo\.com\/(.+\/)?([\d]+)$/)?e("_embed[]",c):c.match(/\/\/(www\.)?dailymotion\.com\/video\/.+$/)?e("_embed[]",c):c.match(/\/\/soundcloud\.com\/.+$/)?e("_embed[]",c):c.match(/\/\/twitter\.com\/[^\/]+\/status\/[\d]+$/)?e("_embed[]",c):c.match(/\/\/vine\.co\/v\/[^\/]+/)&&e("_embed[]",c),h=p.getElementsByTagName("meta")||[];for(var t=0;t<h.length&&!(t>=50);t++){var u=h[t],v=u.getAttribute("name"),w=u.getAttribute("property"),x=u.getAttribute("content");v?e("_meta["+v+"]",x):w&&e("_meta["+w+"]",x)}i=p.getElementsByTagName("link")||[];for(var y=0;y<i.length&&!(y>=50);y++){var z=i[y],A=z.getAttribute("rel");if(A)switch(A){case"canonical":case"icon":case"shortlink":e("_links["+A+"]",z.getAttribute("href"));break;case"alternate":"application/json+oembed"===z.getAttribute("type")?e("_links["+A+"]",z.getAttribute("href")):"handheld"===z.getAttribute("media")&&e("_links["+A+"]",z.getAttribute("href"))}}b.body.getElementsByClassName&&(j=b.body.getElementsByClassName("hfeed")[0]),j=b.getElementById("content")||j||b.body,k=j.getElementsByTagName("img")||[];for(var B=0;B<k.length&&!(B>=50);B++)k[B].src.indexOf("avatar")>-1||k[B].className.indexOf("avatar")>-1||(q.src=k[B].src,q.width>=256&&q.height>=128&&e("_img[]",q.src));l=b.body.getElementsByTagName("iframe")||[];for(var C=0;C<l.length&&!(C>=50);C++)e("_embed[]",l[C].src);b.title&&e("t",b.title),m&&e("s",m),o.setAttribute("method","POST"),o.setAttribute("action",d),o.setAttribute("target",r),o.setAttribute("style","display: none;"),a.open("about:blank",r,"location,resizable,scrollbars,width="+f+",height="+g),b.body.appendChild(o),o.submit()}})(window,document,top.location.href,window.pt_url);
\ No newline at end of file
diff --git a/src/wp-admin/js/press-this.js b/src/wp-admin/js/press-this.js
index e948056794..e64e882185 100644
--- a/src/wp-admin/js/press-this.js
+++ b/src/wp-admin/js/press-this.js
@@ -6,6 +6,7 @@
 	var PressThis = function() {
 		var editor,
 			saveAlert             = false,
+			textarea              = document.createElement( 'textarea' ),
 			siteConfig            = window.wpPressThisConfig || {},
 			data                  = window.wpPressThisData || {},
 			smallestWidth         = 128,
@@ -60,24 +61,20 @@
 			return string
 				.replace( /<!--[\s\S]*?(-->|$)/g, '' )
 				.replace( /<(script|style)[^>]*>[\s\S]*?(<\/\1>|$)/ig, '' )
-				.replace( /<\/?[a-z][^>]*>/ig, '' );
+				.replace( /<\/?[a-z][\s\S]*?(>|$)/ig, '' );
 		}
 
 		/**
-		 * Strip HTML tags and entity encode some of the HTML special chars.
+		 * Strip HTML tags and convert HTML entities.
 		 *
 		 * @param text string Text.
 		 * @returns string Sanitized text.
 		 */
 		function sanitizeText( text ) {
 			text = stripTags( text );
+			textarea.innerHTML = text;
 
-			return text
-				.replace( /\\/, '' )
-				.replace( /</g, '&lt;' )
-				.replace( />/g, '&gt;' )
-				.replace( /"/g, '&quot;' )
-				.replace( /'/g, '&#039;' );
+			return stripTags( textarea.value );
 		}
 
 		/**
@@ -213,70 +210,6 @@
 			return content || '';
 		}
 
-		/**
-		 * Tests if what was passed as an embed URL is deemed to be embeddable in the editor.
-		 *
-		 * @param url string Passed URl, usually from WpPressThis_App.data._embed
-		 * @returns boolean
-		 */
-		function isEmbeddable( url ) {
-			if ( ! url ) {
-				return false;
-			} else if ( url.match( /\/\/(m\.|www\.)?youtube\.com\/watch\?/ ) || url.match( /\/youtu\.be\/.+$/ ) ) {
-				return true;
-			} else if ( url.match( /\/\/vimeo\.com\/(.+\/)?[\d]+$/ ) ) {
-				return true;
-			} else if ( url.match( /\/\/(www\.)?dailymotion\.com\/video\/.+$/ ) ) {
-				return true;
-			} else if ( url.match( /\/\/soundcloud\.com\/.+$/ ) ) {
-				return true;
-			} else if ( url.match( /\/\/twitter\.com\/[^\/]+\/status\/[\d]+$/ ) ) {
-				return true;
-			} else if ( url.match( /\/\/vine\.co\/v\/[^\/]+/ ) ) {
-				return true;
-			}
-
-			return false;
-		}
-
-		/**
-		 * Tests if what was passed as an image URL is deemed to be interesting enough to offer to the user for selection.
-		 *
-		 * @param src string Passed URl, usually from WpPressThis_App.data._ing
-		 * @returns boolean Test for false
-		 */
-		function isSrcUninterestingPath( src ) {
-			if ( src.match( /\/ad[sx]{1}?\// ) ) {
-				// Ads
-				return true;
-			} else if ( src.match( /(\/share-?this[^\.]+?\.[a-z0-9]{3,4})(\?.*)?$/ ) ) {
-				// Share-this type button
-				return true;
-			} else if ( src.match( /\/(spinner|loading|spacer|blank|rss)\.(gif|jpg|png)/ ) ) {
-				// Loaders, spinners, spacers
-				return true;
-			} else if ( src.match( /\/([^\.\/]+[-_]{1})?(spinner|loading|spacer|blank)s?([-_]{1}[^\.\/]+)?\.[a-z0-9]{3,4}/ ) ) {
-				// Fancy loaders, spinners, spacers
-				return true;
-			} else if ( src.match( /([^\.\/]+[-_]{1})?thumb[^.]*\.(gif|jpg|png)$/ ) ) {
-				// Thumbnails, too small, usually irrelevant to context
-				return true;
-			} else if ( src.match( /\/wp-includes\// ) ) {
-				// Classic WP interface images
-				return true;
-			} else if ( src.match( /[^\d]{1}\d{1,2}x\d+\.(gif|jpg|png)$/ ) ) {
-				// Most often tiny buttons/thumbs (< 100px wide)
-				return true;
-			} else if ( src.indexOf( '/g.gif' ) > -1 ) {
-				// Classic WP stats gif
-				return true;
-			} else if ( src.indexOf( '/pixel.mathtag.com' ) > -1 ) {
-				// See mathtag.com
-				return true;
-			}
-			return false;
-		}
-
 		/**
 		 * Get a list of valid embeds from what was passed via WpPressThis_App.data._embed on page load.
 		 *
@@ -292,9 +225,6 @@
 					if ( !src || !src.length ) {
 						// Skip: no src value
 						return;
-					} else if ( !isEmbeddable( src ) ) {
-						// Skip: not deemed embeddable
-						return;
 					}
 
 					var schemelessSrc = src.replace( /^https?:/, '' );
@@ -312,37 +242,6 @@
 			return interestingEmbeds;
 		}
 
-		/**
-		 * Get what is likely the most valuable image from what was passed via WpPressThis_App.data._img and WpPressThis_App.data._meta on page load.
-		 *
-		 * @returns array
-		 */
-		function getFeaturedImage( data ) {
-			var featured = '';
-
-			if ( ! data || ! data._meta ) {
-				return '';
-			}
-
-			if ( data._meta['twitter:image0:src'] && data._meta['twitter:image0:src'].length ) {
-				featured = data._meta['twitter:image0:src'];
-			} else if ( data._meta['twitter:image0'] && data._meta['twitter:image0'].length ) {
-				featured = data._meta['twitter:image0'];
-			} else if ( data._meta['twitter:image:src'] && data._meta['twitter:image:src'].length ) {
-				featured = data._meta['twitter:image:src'];
-			} else if ( data._meta['twitter:image'] && data._meta['twitter:image'].length ) {
-				featured = data._meta['twitter:image'];
-			} else if ( data._meta['og:image'] && data._meta['og:image'].length ) {
-				featured = data._meta['og:image'];
-			} else if ( data._meta['og:image:secure_url'] && data._meta['og:image:secure_url'].length ) {
-				featured = data._meta['og:image:secure_url'];
-			}
-
-			featured = checkUrl( featured );
-
-			return ( isSrcUninterestingPath( featured ) ) ? '' : featured;
-		}
-
 		/**
 		 * Get a list of valid images from what was passed via WpPressThis_App.data._img and WpPressThis_App.data._meta on page load.
 		 *
@@ -350,15 +249,9 @@
 		 */
 		function getInterestingImages( data ) {
 			var imgs             = data._img || [],
-				featuredPict     = getFeaturedImage( data ) || '',
 				interestingImgs  = [],
 				alreadySelected  = [];
 
-			if ( featuredPict.length ) {
-				interestingImgs.push( featuredPict );
-				alreadySelected.push( featuredPict.replace(/^https?:/, '') );
-			}
-
 			if ( imgs.length ) {
 				$.each( imgs, function ( i, src ) {
 					src = src.replace( /http:\/\/[\d]+\.gravatar\.com\//, 'https://secure.gravatar.com/' );
@@ -374,9 +267,6 @@
 					if ( Array.prototype.indexOf && alreadySelected.indexOf( schemelessSrc ) > -1 ) {
 						// Skip: already shown
 						return;
-					} else if ( isSrcUninterestingPath( src ) ) {
-						// Skip: spinner, stat, ad, or spacer pict
-						return;
 					} else if ( src.indexOf( 'avatar' ) > -1 && interestingImgs.length >= 15 ) {
 						// Skip:  some type of avatar and we've already gathered more than 23 diff images to show
 						return;
@@ -665,10 +555,6 @@
 				$.each( interestingEmbeds, function ( i, src ) {
 					src = checkUrl( src );
 
-					if ( ! isEmbeddable( src ) ) {
-						return;
-					}
-
 					var displaySrc = '',
 						cssClass   = 'suggested-media-thumbnail suggested-media-embed';
 
diff --git a/src/wp-includes/link-template.php b/src/wp-includes/link-template.php
index a0584efbea..8ac4a4de45 100644
--- a/src/wp-includes/link-template.php
+++ b/src/wp-includes/link-template.php
@@ -2596,7 +2596,7 @@ function paginate_comments_links($args = array()) {
 function get_shortcut_link() {
 	global $is_IE, $wp_version;
 
-	$bookmarklet_version = '5';
+	$bookmarklet_version = '6';
 	$link = '';
 
 	if ( $is_IE ) {