wp-includes/kses.php:1984Sanitizes a string and removed disallowed URL protocols.
$contentstring$allowed_protocolsstring[]stringfunction wp_kses_bad_protocol( $content, $allowed_protocols ) { $content = wp_kses_no_null( $content ); // Short-circuit if the string starts with `https://` or `http://`. Most common cases. if ( ( str_starts_with( $content, 'https://' ) && in_array( 'https', $allowed_protocols, true ) ) || ( str_starts_with( $content, 'http://' ) && in_array( 'http', $allowed_protocols, true ) ) ) { return $content; } $iterations = 0; do { $original_content = $content; $content = wp_kses_bad_protocol_once( $content, $allowed_protocols ); } while ( $original_content !== $content && ++$iterations < 6 ); if ( $original_content !== $content ) { return ''; } return $content;}Introduced in 1.0.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/kses.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.