diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php
index 4114ed9..f667e8a 100644
--- a/core/lib/Drupal/Component/Utility/Xss.php
+++ b/core/lib/Drupal/Component/Utility/Xss.php
@@ -22,13 +22,13 @@ class Xss {
   protected static $adminTags = array('a', 'abbr', 'acronym', 'address', 'article', 'aside', 'b', 'bdi', 'bdo', 'big', 'blockquote', 'br', 'caption', 'cite', 'code', 'col', 'colgroup', 'command', 'dd', 'del', 'details', 'dfn', 'div', 'dl', 'dt', 'em', 'figcaption', 'figure', 'footer', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'hgroup', 'hr', 'i', 'img', 'ins', 'kbd', 'li', 'mark', 'menu', 'meter', 'nav', 'ol', 'output', 'p', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'small', 'span', 'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'tr', 'tt', 'u', 'ul', 'var', 'wbr');
 
   /**
-   * The list of html tags to allow for a given filter operation.
+   * The list of html tags allowed in \Drupal\Component\Utility\Xss::filter().
    *
    * @var array
    *
-   * @see \Drupal\Component\Utility\Xss::split()
+   * @see \Drupal\Component\Utility\Xss::filter()
    */
-  protected static $allowedTags = array('a', 'em', 'strong', 'cite', 'blockquote', 'code', 'ul', 'ol', 'li', 'dl', 'dt', 'dd');
+  protected static $allowedTags = array();
 
   /**
    * Filters HTML to prevent cross-site-scripting (XSS) vulnerabilities.
@@ -64,7 +64,7 @@ public static function filter($string, $allowed_tags = array('a', 'em', 'strong'
       return '';
     }
     // Store the text format.
-    static::$allowedTags = $allowed_tags;
+    static::$allowedTags = array_flip($allowed_tags);
     // Remove NULL characters (ignored by some browsers).
     $string = str_replace(chr(0), '', $string);
     // Remove Netscape 4 JS entities.
@@ -116,14 +116,16 @@ public static function filterAdmin($string) {
    * Processes an HTML tag.
    *
    * @param array $matches
-   *   An array containing a single HTML tag to process.
+   *   An array with one element, the HTML tag to process.
    *
    * @return string
    *   If the element isn't allowed, an empty string. Otherwise, the cleaned up
    *   version of the HTML element.
    */
-  protected static function split(array $matches) {
-    $string = $matches[0];
+  protected static function split($matches) {
+
+    $string = $matches[1];
+
     if (substr($string, 0, 1) != '<') {
       // We matched a lone ">" character.
       return '&gt;';