Skip to content

Commit 706b8a8

Browse files
t-hamanoclaude
t-hamano
and
claude
committed
Icons: Simplify the allowed attribute lists in the icon SVG sanitizer with a helper method.
Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 27b2d08 commit 706b8a8

1 file changed

Lines changed: 65 additions & 53 deletions

File tree

‎src/wp-includes/class-wp-icons-registry.php‎

Lines changed: 65 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,18 @@ public function unregister( $icon_name ) {
239239
return true;
240240
}
241241

242+
/**
243+
* Builds the allowed attribute list for wp_kses() from attribute names.
244+
*
245+
* @since 7.2.0
246+
*
247+
* @param non-empty-string ...$attribute_names Attribute names to allow.
248+
* @return array<non-empty-string, true> Attribute names mapped to true.
249+
*/
250+
private function get_allowed_attribute_list( ...$attribute_names ): array {
251+
return array_fill_keys( $attribute_names, true );
252+
}
253+
242254
/**
243255
* Sanitizes the icon SVG content.
244256
*
@@ -248,79 +260,79 @@ public function unregister( $icon_name ) {
248260
* @return string The sanitized icon SVG content.
249261
*/
250262
protected function sanitize_icon_content( $icon_content ) {
251-
$stroke_attributes = array(
252-
'style' => true,
253-
'stroke' => true,
254-
'stroke-width' => true,
255-
'stroke-linecap' => true,
256-
'stroke-linejoin' => true,
257-
'stroke-miterlimit' => true,
258-
'vector-effect' => true,
263+
$stroke_attributes = $this->get_allowed_attribute_list(
264+
'style',
265+
'stroke',
266+
'stroke-width',
267+
'stroke-linecap',
268+
'stroke-linejoin',
269+
'stroke-miterlimit',
270+
'vector-effect',
259271
);
260272

261273
$allowed_tags = array(
262274
'svg' => array_merge(
263-
array(
264-
'class' => true,
265-
'xmlns' => true,
266-
'width' => true,
267-
'height' => true,
268-
'viewbox' => true,
269-
'aria-hidden' => true,
270-
'role' => true,
271-
'focusable' => true,
272-
'fill' => true,
273-
'fill-rule' => true,
274-
'clip-rule' => true,
275+
$this->get_allowed_attribute_list(
276+
'class',
277+
'xmlns',
278+
'width',
279+
'height',
280+
'viewbox',
281+
'aria-hidden',
282+
'role',
283+
'focusable',
284+
'fill',
285+
'fill-rule',
286+
'clip-rule',
275287
),
276288
$stroke_attributes
277289
),
278290
'path' => array_merge(
279-
array(
280-
'fill' => true,
281-
'fill-rule' => true,
282-
'clip-rule' => true,
283-
'd' => true,
284-
'opacity' => true,
285-
'transform' => true,
291+
$this->get_allowed_attribute_list(
292+
'fill',
293+
'fill-rule',
294+
'clip-rule',
295+
'd',
296+
'opacity',
297+
'transform',
286298
),
287299
$stroke_attributes
288300
),
289301
'polygon' => array_merge(
290-
array(
291-
'fill' => true,
292-
'fill-rule' => true,
293-
'clip-rule' => true,
294-
'points' => true,
295-
'transform' => true,
296-
'focusable' => true,
302+
$this->get_allowed_attribute_list(
303+
'fill',
304+
'fill-rule',
305+
'clip-rule',
306+
'points',
307+
'transform',
308+
'focusable',
297309
),
298310
$stroke_attributes
299311
),
300312
'rect' => array_merge(
301-
array(
302-
'fill' => true,
303-
'fill-rule' => true,
304-
'clip-rule' => true,
305-
'x' => true,
306-
'y' => true,
307-
'width' => true,
308-
'height' => true,
309-
'rx' => true,
310-
'ry' => true,
311-
'transform' => true,
313+
$this->get_allowed_attribute_list(
314+
'fill',
315+
'fill-rule',
316+
'clip-rule',
317+
'x',
318+
'y',
319+
'width',
320+
'height',
321+
'rx',
322+
'ry',
323+
'transform',
312324
),
313325
$stroke_attributes
314326
),
315327
'circle' => array_merge(
316-
array(
317-
'fill' => true,
318-
'fill-rule' => true,
319-
'clip-rule' => true,
320-
'cx' => true,
321-
'cy' => true,
322-
'r' => true,
323-
'transform' => true,
328+
$this->get_allowed_attribute_list(
329+
'fill',
330+
'fill-rule',
331+
'clip-rule',
332+
'cx',
333+
'cy',
334+
'r',
335+
'transform',
324336
),
325337
$stroke_attributes
326338
),

0 commit comments

Comments
 (0)