# Sanitizer Changes Carry Site-Wide Blast Radius ## Claim A change to a shared sanitization function breaks every consumer of the markup pattern it touches at once, so sanitizer edits need regression tests across all affected output shapes, not just the case that motivated the change. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for any centralized input/output filter that many independent callers rely on — a core sanitizer, a shared escaping helper, a single validation layer sitting in front of many features. - Breaks down for narrowly scoped, single-caller helpers, where a regression is contained to the one thing that called it. - Doesn't establish how to catch this class of regression before release — only that the blast radius is structural, not incidental. ## Evidence WordPress 7.0.1 fixed a regression in `wp_kses()`, the function WordPress uses to sanitize HTML, that had been silently corrupting valid `background-image: url(…)` CSS declarations down to a bare `style=")"`. Because `wp_kses()` is a shared, widely-called sanitizer rather than a feature-specific check, the regression didn't just break one theme or plugin — it broke every theme and plugin relying on inline background images, simultaneously, the moment 7.0 shipped. ## Links - [[3. Resources/Permanent Notes/A Parser Disagreement Between Two Sanitizers Is the Exploitable Seam]] — because contrasts; that note is about two sanitizers disagreeing with each other (a parser-differential vulnerability), this one is about a single sanitizer regressing — different mechanisms, same underlying lesson that shared sanitization surface is high-leverage and high-risk. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in; sanitize/escape is core to the security trinity this MOC tracks. ## Tests / falsifiers - Find a WordPress core sanitizer regression that shipped and stayed narrowly contained to a single plugin rather than fanning out across all callers — would show the blast-radius claim isn't structural. - Compare the fix turnaround time for shared-sanitizer bugs versus single-caller validation bugs across several WordPress point releases; if shared-sanitizer bugs don't get fixed faster or flagged more urgently, the "outsized blast radius" claim isn't actually driving triage priority in practice. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/WordPress 7.0.1 Now Available, Fixes 31 Bugs]] — reports the `wp_kses()` regression and its site-wide inline-background-image breakage.