Skip to content

Icons: Skip sanitizing the icons bundled with WordPress - #14492

Open
fushar wants to merge 2 commits into
WordPress:trunkfrom
fushar:icons-skip-kses-bundled
Open

Icons: Skip sanitizing the icons bundled with WordPress#14492
fushar wants to merge 2 commits into
WordPress:trunkfrom
fushar:icons-skip-kses-bundled

Conversation

@fushar

@fushar fushar commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Trac ticket: https://core.trac.wordpress.org/ticket/66338.
Backport of WordPress/gutenberg#85083.

Skips the wp_kses() sanitization of the core icons bundled with WordPress, in wp-includes/images/icon-library/.

#12270 renders the admin bar and admin menu icons with wp_get_icon(), so every wp-admin page now loads about 20 icons through the registry. Measurements on that PR show about +3.5 ms of server time per wp-admin page, and most of the icon cost is wp_kses(). The core icons ship with WordPress and are as trusted as the rest of wp-includes, so sanitizing does not really protect anything.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: code generation, with my supervision.

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

@fushar fushar mentioned this pull request Oct 19, 2026
Open
@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

@fushar
fushar force-pushed the icons-skip-kses-bundled branch from 3908ac2 to e85a551 Compare October 19, 2026 11:08
@fushar
fushar marked this pull request as ready for review October 19, 2026 11:26
@github-actions

github-actions Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props fushar, wildworks.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

  • @propsbot add <username> to give props to a GitHub user. Requires write access.
  • @propsbot remove <username> to leave a user out of the props. Requires write access.
  • @propsbot refresh to refresh this list. Adding the props-bot label works too.

@fushar
fushar requested review from mcsf and t-hamano October 19, 2026 11:29
t-hamano
t-hamano reviewed Oct 23, 2026
View reviewed changes
Comment thread src/wp-includes/class-wp-icons-registry.php Outdated
Comment thread tests/phpunit/tests/icons/wpIconsRegistry.php
fushar added 2 commits October 23, 2026 11:13
@fushar
Icons: Skip sanitizing the icons bundled with WordPress.
887e766 
The core icons ship with WordPress and are trusted, and sanitizing them with
wp_kses() is the main cost of rendering them.
@fushar
Address comments
fa2f8de
@fushar
fushar force-pushed the icons-skip-kses-bundled branch from e85a551 to fa2f8de Compare October 23, 2026 04:15
@fushar

fushar commented Oct 23, 2026

Copy link
Copy Markdown
Author

@t-hamano Thanks for the review and welcome back! All make sense, I've applied them and re-test this PR.

t-hamano
t-hamano approved these changes Oct 23, 2026
View reviewed changes

@t-hamano t-hamano left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good on my end. I would like to commit this in time for 7.2 Beta 2, but @mcsf, please feel free to leave any feedback if needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@t-hamano t-hamano t-hamano approved these changes
@mcsf mcsf Awaiting requested review from mcsf

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@fushar @t-hamano