KSES: Preserve some additional invalid HTML comment syntaxes. by dmsnell · Pull Request #6395 · WordPress/wordpress-develop

dmsnell · 2024-04-15T14:32:47Z

Status

The one test failure appears to be related to deprecating the outdated IE comment syntax. It's not a problem because the test enshrines a mis-parsing of special HTML comments.

This change fixes that mis-parsing and will prevent further corruption.

Description

When wp_kses_split processes a document it attempts to leave HTML comments alone. It makes minor adjustments, but leaves the comments in the document in its output. Unfortunately it only recognizes one kind of HTML comment and rejects many others.

In HTML there are many kinds of invalid markup which, according to the specification, are to be interpreted as an HTML comment. These include, but are not limited to:

HTML comments with invalid syntax, <!-->, <!-- --!>, etc…
HTML closing tags whose tag name is invalid </3>, </%happy>, etc…
Things that look like XML CDATA sections, <![CDATA[…]]>
Things that look like XML Processor Instruction nodes, <?include "blarg">

This patch makes a minor adjustment to the algorithm in wp_kses_split to allow two additional kinds of HTML comments:

HTML comments with the incorrect closer --!>, because this one was a simple and easy change.
Closing tags with an invalid tag name, e.g. </%dolly>, because these are required to open up explorations in Gutenberg on Bits, a new iteration of dynamic tokens for externally-sourced data, or "Shortcodes 2.0"

These invalid closing tags, which in a browser are interpreted as comments, are one proposal for a placeholder mechanism in the HTML API unlocking HTML templating, a new kind of shortcode, and more. Having these persist in Core is a requirement for exploring and utilizing the new syntax because as long as Core removes them, there's no way to load content from the database and experiment on the full life cycle of potential Bits systems.

On its own, however, this represents a kind of bug fix for Core, making the implementation of wp_kses_split() more closely align with its stated goal of leaving HTML comments as comments. It doesn't attempt to fully fix the mis-parsed comments (because that is a much deeper issue and involves many more questions about existing expectations) but it does propose a couple of hopefully and expectedly minor fixes that hopefully won't break any existing code or projects.

Discussion

Concerning the removed kses test, as far as I can tell there is no support for conditional comments like these after IE9, which I believe we don't support anymore. All modern browsers will interpret the entire span of content as a single comment.

Unfortunately there's a twist to the attack which follow best-practice recommendations for conditional comments, which is to add a short abruptly-closed comment after the opening.

<!--[if gte IE 4]><!-->
<SCRIPT>alert('XSS');</SCRIPT>
<![endif]-->

The addition of <!--> ends the opening comment and re-reveals the <SCRIPT> tag. However, this should not affect the security of WordPress because it will be looking for the SCRIPT tags through other code paths after the removal of this restriction.

Warning: Should verify this in a clear way.

When `wp_kses_split` processes a document it attempts to leave HTML comments relatively alone. It makes minor adjustments, but leaves the comments in the document in its output. Unfortunately it only recognizes one kind of HTML comment and rejects many other kinds which appear as the result of various invalid HTML markup. This patch makes a minor adjustment to the algorithm in `wp_kses_split` to allow two additional kinds of HTML comments: - HTML comments with the incorrect closer `--!>`. - Closing tags with an invalid tag name, e.g. `</%dolly>`. In an HTML parser these all become comments, and so leaving them in the document should be a benign operation, improving the reliability of detecting comments in Core. These invalid closing tags, which in a browser are interpreted as comments, are one proposal for a placeholder mechanism in the HTML API unlocking HTML templating, a new kind of shortcode, and more. Having these persist in Core is a requirement for exploring and utilizing the new syntax.

github-actions · 2024-04-15T14:33:04Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props dmsnell, zieladam, ellatrix, westonruter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2024-04-15T14:49:22Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

The Plugin and Theme Directories cannot be accessed within Playground.
All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

adamziel · 2024-04-16T09:54:40Z

The test failure is related to IE conditional comments. However, dealing with those shouldn't matter anymore:

Conditional comments are conditional statements interpreted by Microsoft Internet Explorer versions 5 through 9 in HTML source code

https://www.sitepoint.com/microsoft-drop-ie10-conditional-comments/

adamziel · 2024-04-16T09:59:37Z

+	 * it should be interpreted as an HTML comment. It extends until the
+	 * first `>` character after the initial opening `</`.
+	 */
+	if ( 1 === preg_match( '~</[^a-zA-Z][^>]*>~', $content ) ) {


So this bales out an returns $content if there is a match anywhere in the string. Is this expected? Would this kick in if that's inside of an attribute?

good call: I think this needs anchors. I'll review it and add them accordingly

adamziel · 2024-04-16T10:13:52Z

Other than my preg_match question, this LGTM. I'd just remove the failing test case, conditional comments were only relevant up to IE9 which WordPress doesn't support anymore. And even if it did, the new output doesn't seem like an XSS vector. I'd still get inputs from others, cc @westonruter

westonruter · 2024-04-16T18:16:56Z

Confirmed that Chrome parses these as comments:

<!-- comment 1 -->
foo
<!-- comment 2 --!>
bar
</%comment3>
baz

How common are these other invalid comments?

I presume you'll be adding tests specifically for the changes here?

dmsnell · 2024-04-17T13:50:15Z

How common are these other invalid comments?

I'm guessing rare, but it might be a fun experiment to scan some sites and count them. This patch only addresses a single kind of invalid comment leaving most other constructions alone. This is because I'm trying to be tactical here and leave a small surface area of change.

I presume you'll be adding tests specifically for the changes here?

Yes absolutely. Before I do that though I want to make sure folks are on board with the change. If we use these "funky comments" for Bits, template placeholders, translation wrappers, they could become quite popular.

In a local branch I was playing with replacing wp_kses_split2 using the HTML API and it provides some great affordances, but as usual, far more questions to resolve.

For instance, WordPress currently strips away <:::>, interpreting it as an invalid tag. It's not though, it's legitimate plaintext despite being invalid markup. So now what do we do?

Do we attempt to maintain this legacy behavior that corrupts documents that otherwise are fine?
Do we preserve this legitimate HTML and allow its surprising form to thread through a stack of code expecting more familiar HTML?
Do we eagerly replace confusing HTML like this before passing it along into WordPress, taking a performance hit to provide regularity and mitigate further misinterpretation by later code on the render chain?

There are further nuances. For now I would like to preserve just this one case so that we can get testing and exploring the UX of potential "Bits" systems. In my opinion this code is no worse off than the existing code, so the fact that it doesn't solve more syntax irregularities seems like something that shouldn't be required.

westonruter · 2024-04-17T20:52:02Z

This patch only addresses a single kind of invalid comment leaving most other constructions alone.

Is there a list of all the possible invalid comment syntaxes?

dmsnell · 2024-04-18T15:47:50Z

Is there a list of all the possible invalid comment syntaxes?

They are not listed separated like this but you can find them in the parsing errors in the specification.

The Tag Processor draws its own classification which is retrievable with get_comment_type(), whereas it distinguishes:

Comments that are basically well-formed.
Comments that were abruptly closed.
Comments that appear as though someone wanted to write a CDATA section.
Comments that appear as though someone wanted to write an SGML processing instruction.
Comments that form from a variety of other invalid HTML constructions.

It separates out comments that appear as the result of being a closing tag with an invalid tag name. These it calls funky comments and these are the proposed syntax for Bits and other atomic shortcode like placeholders.

dmsnell · 2024-04-19T16:47:57Z

How common are these other invalid comments?

@westonruter I took a list of the top-ranked domains and grabbed the first 296,000 pages at / for the domain.

invalid-comments.txt

This file has ANSI terminal codes for clearer output. You can cat it and see colors…

ellatrix · 2024-06-12T15:47:40Z

+	(                         # Detect comments of various flavors before attempting to find tags.
+		(?:<!--.*?(--!?>|$))  # Well-formed HTML comments like `<!-- ... -->` and also with invalid `--!>` closer.
+		|
+		</[^a-zA-Z][^>]*>     # Closing tags with invalid tag names.


Stupid question: could we somehow reuse the same part of the regular expression </[^a-zA-Z][^>]*> below?

Not stupid, but while we can do that, it's valuable IMO to leave this separate, as the closing tag with an invalid tag name has an incredibly simple and straightforward syntax pattern: the tag name starts with anything that isn't a - z (ASCII case-insensitive) and extends until the first >.

So by leaving this separate we can be even more careful about what we're examining. For example, opening tags with invalid tag names are not interpreted as invalid comments. The following pattern just isn't very robust in detecting normal tags let alone invalid ones, so as long as the correct approach is simpler being separate, I think it's worthwhile not joining them.

ellatrix · 2024-06-12T15:54:45Z

Thanks for omitting the others improvements, it really helps to understand that they are not related to allowing the some additional invalid comment syntaxes and are completely separate fixes. It also reduces the risk of a revert in the unlikely that case there's a problem with the additional fixes. Let's do those in a separate PR 👍

dmsnell · 2024-06-12T16:01:07Z

+		while ( $transformed !== $content ) {
+			$transformed = wp_kses( $content, $allowed_html, $allowed_protocols );
+			$content     = $transformed;
+		}


this is copied from the existing comment behavior below

Could use an inline comment?

ellatrix

Looks good to me know, love the changes to make it more concise.

ellatrix · 2024-06-12T16:05:59Z

 	$content = wp_kses_stripslashes( $content );

-	// It matched a ">" character.
+	/*


Should wp_kses_split2 also get an updated @since?

Yes, great idea. Thanks for catching it!

ellatrix

Should we maybe add an extra unit test case?

dmsnell · 2024-06-12T16:21:17Z

Found an issue with encoding HTML comments, I'll examine.

Update: Was testing locally on another branch and got confused; all is fine.

westonruter

LGTM!

westonruter · 2024-06-12T16:34:17Z

+		|
+		</[^a-zA-Z][^>]*>  #  - Closing tags with invalid tag names.


These two lines are essentially the only change to the regex pattern (an addition).

adamziel · 2024-06-12T19:15:07Z

+	 * first `>` character after the initial opening `</`.
+	 *
+	 * Preserve these comments and do not treat them like tags.
+	 */


Would the > character ever not terminate the string? In other words, what would change if you removed the $ from the regexp?

Aha, I know now. Then we couldn’t assume bkw that the content starts at the at index two and ends at index minus one

adamziel · 2024-06-12T19:18:43Z

+	 *
+	 * Preserve these comments and do not treat them like tags.
+	 */
+	if ( 1 === preg_match( '~^</[^a-zA-Z][^>]*>$~', $content ) ) {


Is there any need to check for any invalid comment closers? I’m on a bus and can't remember exactly, but there were cases like triple dash or cdata-lookalike closer. Or does none of that matter with these tag-closer-like comments?

adamziel

I left a few notes I mean mostly as double-checking questions - I think you got everything right here and we’re good to go. Thank you!

As a side note, I’d love to see a fuzzer trying all the different risky inputs with and without every kses PR

When `wp_kses_split` processes a document it attempts to leave HTML comments alone. It makes minor adjustments, but leaves the comments in the document in its output. Unfortunately it only recognizes one kind of HTML comment and rejects many others. This patch makes a minor adjustment to the algorithm in `wp_kses_split` to recognize and preserve an additional kind of HTML comment: closing tags with an invalid tag name, e.g. `</%dolly>`. These invalid closing tags must be interpreted as comments by a browser. This bug fix aligns the implementation of `wp_kses_split()` more closely with its stated goal of leaving HTML comments as comments. It doesn't attempt to fully fix the mis-parsed comments, but it does propose a minor fix that hopefully won't break any existing code or projects. Developed in #6395 Discussed in https://core.trac.wordpress.org/ticket/61009 Props ellatrix, dmsnell, joemcgill, jorbin, westonruter, zieladam. See #61009. git-svn-id: https://develop.svn.wordpress.org/trunk@58418 602fd350-edb4-49c9-b593-d223f7449a82

dmsnell · 2024-06-15T06:33:27Z

Merged in [58418]
c756dfe

When `wp_kses_split` processes a document it attempts to leave HTML comments alone. It makes minor adjustments, but leaves the comments in the document in its output. Unfortunately it only recognizes one kind of HTML comment and rejects many others. This patch makes a minor adjustment to the algorithm in `wp_kses_split` to recognize and preserve an additional kind of HTML comment: closing tags with an invalid tag name, e.g. `</%dolly>`. These invalid closing tags must be interpreted as comments by a browser. This bug fix aligns the implementation of `wp_kses_split()` more closely with its stated goal of leaving HTML comments as comments. It doesn't attempt to fully fix the mis-parsed comments, but it does propose a minor fix that hopefully won't break any existing code or projects. Developed in WordPress/wordpress-develop#6395 Discussed in https://core.trac.wordpress.org/ticket/61009 Props ellatrix, dmsnell, joemcgill, jorbin, westonruter, zieladam. See #61009. Built from https://develop.svn.wordpress.org/trunk@58418 git-svn-id: http://core.svn.wordpress.org/trunk@57867 1a063a9b-81f0-0310-95a4-ce76da25c4cd

When `wp_kses_split` processes a document it attempts to leave HTML comments alone. It makes minor adjustments, but leaves the comments in the document in its output. Unfortunately it only recognizes one kind of HTML comment and rejects many others. This patch makes a minor adjustment to the algorithm in `wp_kses_split` to recognize and preserve an additional kind of HTML comment: closing tags with an invalid tag name, e.g. `</%dolly>`. These invalid closing tags must be interpreted as comments by a browser. This bug fix aligns the implementation of `wp_kses_split()` more closely with its stated goal of leaving HTML comments as comments. It doesn't attempt to fully fix the mis-parsed comments, but it does propose a minor fix that hopefully won't break any existing code or projects. Developed in WordPress/wordpress-develop#6395 Discussed in https://core.trac.wordpress.org/ticket/61009 Props ellatrix, dmsnell, joemcgill, jorbin, westonruter, zieladam. See #61009. Built from https://develop.svn.wordpress.org/trunk@58418 git-svn-id: https://core.svn.wordpress.org/trunk@57867 1a063a9b-81f0-0310-95a4-ce76da25c4cd

The icon sanitizer in `WP_Icons_Registry` stripped valid SVG markup, so icons using fill rules, clip paths, strokes, or shapes such as `rect` and `circle` did not render correctly. Expand the allow-list for `svg` and `path` to permit that markup, allow the same stroke attributes on `polygon`, and add `rect` and `circle` as newly allowed elements. Developed in: #6395 Follow-up to r62748. Props westonruter, wildworks. See #65795. git-svn-id: https://develop.svn.wordpress.org/trunk@63652 602fd350-edb4-49c9-b593-d223f7449a82

The icon sanitizer in `WP_Icons_Registry` stripped valid SVG markup, so icons using fill rules, clip paths, strokes, or shapes such as `rect` and `circle` did not render correctly. Expand the allow-list for `svg` and `path` to permit that markup, allow the same stroke attributes on `polygon`, and add `rect` and `circle` as newly allowed elements. Developed in: WordPress/wordpress-develop#6395 Follow-up to r62748. Props westonruter, wildworks. See #65795. Built from https://develop.svn.wordpress.org/trunk@63652 git-svn-id: http://core.svn.wordpress.org/trunk@62826 1a063a9b-81f0-0310-95a4-ce76da25c4cd

@SInCE

* WP-r55564: KSES: Allow `filter` property to accept a URL in `safecss_filter_attr()`. CSS filters can accept `url()` as a reference to an SVG filter element: {{{ filter: url( file.svg#filter-element-id ); }}} This commit allows for that syntax to be used in inline CSS. Original PR from Gutenberg repository: * [WordPress/gutenberg#48281 https://core.trac.wordpress.org/ticket/48281 Duotone: Use the style engine to generate CSS for Duotone] References: * [https://developer.mozilla.org/en-US/docs/Web/CSS/filter MDN Web Docs: filter()] * [https://developer.mozilla.org/en-US/docs/Web/CSS/url MDN Web Docs: url()] Follow-up to https://core.trac.wordpress.org/changeset/44136, https://core.trac.wordpress.org/changeset/52049. WP:Props scruffian, jeryj, ironprogrammer, azaozz, hellofromTonya, SergeyBiryukov. Fixes https://core.trac.wordpress.org/ticket/57780. --- Merges https://core.trac.wordpress.org/changeset/55564 / WordPress/wordpress-develop@6d1381180b to ClassicPress. * WP-r55642: Coding Standards: Use strict comparison where `count()` is involved. Follow-up to https://core.trac.wordpress.org/changeset/1636, https://core.trac.wordpress.org/changeset/6974, https://core.trac.wordpress.org/changeset/8114, https://core.trac.wordpress.org/changeset/10322, https://core.trac.wordpress.org/changeset/13326, https://core.trac.wordpress.org/changeset/14760, https://core.trac.wordpress.org/changeset/18006, https://core.trac.wordpress.org/changeset/18541, https://core.trac.wordpress.org/changeset/19743, https://core.trac.wordpress.org/changeset/23249, https://core.trac.wordpress.org/changeset/24115, https://core.trac.wordpress.org/changeset/33359. WP:Props aristath, poena, afercia, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/57839. --- Merges https://core.trac.wordpress.org/changeset/55642 / WordPress/wordpress-develop@81598dd34f to ClassicPress. * WP-r55652: Coding Standards: Use strict comparison where `strlen()` is involved. Follow-up to https://core.trac.wordpress.org/changeset/649, https://core.trac.wordpress.org/changeset/1345, https://core.trac.wordpress.org/changeset/3034, https://core.trac.wordpress.org/changeset/6132, https://core.trac.wordpress.org/changeset/6314, https://core.trac.wordpress.org/changeset/6974, https://core.trac.wordpress.org/changeset/55642. WP:Props aristath, poena, afercia, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/57839. Conflicts: - src/wp-includes/load.php --- Merges https://core.trac.wordpress.org/changeset/55652 / WordPress/wordpress-develop@760728c92f to ClassicPress. * Fix merge conflict from 55652 * WP-r55677: Coding Standards: Use strict comparison where `strtolower()` is involved. Follow-up to https://core.trac.wordpress.org/changeset/649, https://core.trac.wordpress.org/changeset/7736, https://core.trac.wordpress.org/changeset/18821, https://core.trac.wordpress.org/changeset/19444, https://core.trac.wordpress.org/changeset/20886, https://core.trac.wordpress.org/changeset/20893, https://core.trac.wordpress.org/changeset/23303, https://core.trac.wordpress.org/changeset/55642, https://core.trac.wordpress.org/changeset/55652, https://core.trac.wordpress.org/changeset/55653, https://core.trac.wordpress.org/changeset/55654. WP:Props aristath, poena, afercia, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/57839. Conflicts: - src/wp-includes/theme.php --- Merges https://core.trac.wordpress.org/changeset/55677 / WordPress/wordpress-develop@c2f262971c to ClassicPress. * Fix merge conflicts from 55677 * WP-r55703: Code Modernization: Replace usage of `strpos()` with `str_starts_with()`. `str_starts_with()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) begins with the given substring (needle). WordPress core includes a polyfill for `str_starts_with()` on PHP < 8.0 as of WordPress 5.9. This commit replaces `0 === strpos( ... )` with `str_starts_with()` in core files, making the code more readable and consistent, as well as improving performance. While `strpos()` is slightly faster than the polyfill on PHP < 8.0, `str_starts_with()` is noticeably faster on PHP 8.0+, as it is optimized to avoid unnecessarily searching along the whole haystack if it does not find the needle. Follow-up to https://core.trac.wordpress.org/changeset/52039, https://core.trac.wordpress.org/changeset/52040, https://core.trac.wordpress.org/changeset/52326. WP:Props spacedmonkey, costdev, sabernhardt, mukesh27, desrosj, jorbin, TobiasBg, ayeshrajans, lgadzhev, SergeyBiryukov. Fixes https://core.trac.wordpress.org/ticket/58012. Conflicts: - src/wp-admin/includes/class-wp-privacy-policy-content.php - src/wp-admin/includes/credits.php - src/wp-admin/includes/post.php - src/wp-admin/includes/privacy-tools.php - src/wp-admin/load-styles.php - src/wp-admin/menu-header.php - src/wp-includes/block-template.php - src/wp-includes/blocks.php - src/wp-includes/bookmark-template.php - src/wp-includes/class-simplepie.php - src/wp-includes/l10n.php - src/wp-includes/pluggable.php - src/wp-includes/post-template.php - src/wp-includes/script-loader.php - src/wp-includes/widgets/class-wp-widget-block.php --- Merges https://core.trac.wordpress.org/changeset/55703 / WordPress/wordpress-develop@4cb3e1582a to ClassicPress. * WP-r55822: General: Use `static` on closures whenever `$this` is not used to avoid memory leaks. WP:Props westonruter, jrf, spacedmonkey. Fixes https://core.trac.wordpress.org/ticket/58323. Conflicts: - src/wp-admin/includes/file.php - src/wp-includes/blocks.php - src/wp-includes/kses.php - src/wp-includes/script-loader.php - tests/performance/wp-content/mu-plugins/server-timing.php - tests/phpunit/tests/admin/wpSiteHealth.php - tests/phpunit/tests/blocks/editor.php - tests/phpunit/tests/blocks/renderCommentTemplate.php - tests/phpunit/tests/blocks/wpBlock.php - tests/phpunit/tests/dependencies/scripts.php - tests/phpunit/tests/media.php - tests/phpunit/tests/rest-api/rest-server.php - tests/phpunit/tests/rest-api/rest-themes-controller.php - tests/phpunit/tests/theme/wpThemeJsonResolver.php --- Merges https://core.trac.wordpress.org/changeset/55822 / WordPress/wordpress-develop@d5792c7a88 to ClassicPress. * WP-r55937: Formatting: Support aria content attributes. Add `aria-controls`, `aria-expanded`, and `aria-current` to allowed attributes in KSES. WP:Props crs1138, rsiddharth, mukesh27, SergeyBiryukov, joedolson, ryokuhi, peterwilsoncc, audrasjb, nataliat2004. Fixes https://core.trac.wordpress.org/ticket/55370. Conflicts: - src/wp-includes/kses.php --- Merges https://core.trac.wordpress.org/changeset/55937 / WordPress/wordpress-develop@1e090291f0 to ClassicPress. * WP-r55944: KSES: Add support for CSS `repeat()` function. Introduces support for the CSS `repeat()` function to support complex grid layouts. WP:Props isabel_brison, azaozz. Fixes https://core.trac.wordpress.org/ticket/58551. Conflicts: - tests/phpunit/tests/kses.php --- Merges https://core.trac.wordpress.org/changeset/55944 / WordPress/wordpress-develop@2b7f865417 to ClassicPress. * Fix merge conflict from 55944 * WP-r56046: Editor: add box shadow support to blocks. Adds the ability for blocks to declare support for CSS box-shadow and processing of necessary styles. WP:Props madhudollu, sabernhardt, ramonopoly, spacedmonkey, mukesh27. Fixes https://core.trac.wordpress.org/ticket/58590. Conflicts: - src/wp-includes/style-engine/class-wp-style-engine.php - src/wp-settings.php - tests/phpunit/tests/style-engine/styleEngine.php --- Merges https://core.trac.wordpress.org/changeset/56046 / WordPress/wordpress-develop@e55e9c2f0c to ClassicPress. * Fix merge conflict from 56046 * WP-r56191: Docs: Replace multiple single line comments with multi-line comments. This changeset updates various comments as per WordPress PHP Inline Documentation Standards. See https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/https://core.trac.wordpress.org/ticket/5-inline-comments. Follow-up to https://core.trac.wordpress.org/changeset/56174, https://core.trac.wordpress.org/changeset/56175, https://core.trac.wordpress.org/changeset/56176, https://core.trac.wordpress.org/changeset/56177, https://core.trac.wordpress.org/changeset/56178, https://core.trac.wordpress.org/changeset/56179, https://core.trac.wordpress.org/changeset/56180. WP:Props costdev, audrasjb. See https://core.trac.wordpress.org/ticket/58459. Conflicts: - src/wp-includes/media.php --- Merges https://core.trac.wordpress.org/changeset/56191 / WordPress/wordpress-develop@3666c0e31b to ClassicPress. * Fix merge conflict from 56191 * WP-r56377: Coding Standards: Use strict comparison in `wp-includes/kses.php`. Follow-up to https://core.trac.wordpress.org/changeset/649, https://core.trac.wordpress.org/changeset/2896, https://core.trac.wordpress.org/changeset/3418, https://core.trac.wordpress.org/changeset/8386, https://core.trac.wordpress.org/changeset/20540, https://core.trac.wordpress.org/changeset/47219, https://core.trac.wordpress.org/changeset/54933. WP:Props aristath, poena, afercia, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/58831. --- Merges https://core.trac.wordpress.org/changeset/56377 / WordPress/wordpress-develop@b1d59267af to ClassicPress. * Manual cherry-pick of 56559 * WP-r56608: Docs: Document `aria-live` and `hidden` in `safecss_filter_attr()`. In https://core.trac.wordpress.org/changeset/56603, support was added for `aria-live` and `hidden` attributes in `safecss_filter_attr()`. This adds a `@since` annotation to document this change. Follow-up to https://core.trac.wordpress.org/changeset/56603. WP:Props mukesh27. See https://core.trac.wordpress.org/ticket/57791. --- Merges https://core.trac.wordpress.org/changeset/56608 / WordPress/wordpress-develop@a7c9394b78 to ClassicPress. * WP-r56617: KSES: Add `writing-mode` to the list of safe CSS properties. Original PR from Gutenberg repository: * [WordPress/gutenberg#54581 https://core.trac.wordpress.org/ticket/54581 Gutenberg Plugin: Add hook to allow `writing-mode` as a safe CSS property] Reference: [https://developer.mozilla.org/en-US/docs/Web/CSS/writing-mode MDN Web Docs: writing-mode]. Follow-up to https://core.trac.wordpress.org/changeset/56605. WP:Props wildworks, mukesh27, poena, andrewserong. Fixes https://core.trac.wordpress.org/ticket/59387. --- Merges https://core.trac.wordpress.org/changeset/56617 / WordPress/wordpress-develop@cf2f441515 to ClassicPress. * WP-r57056: Coding Standards: Remove unnecessary ignore annotation in `wp_kses_hair_parse()`. It is perfectly possible to write a commented regex with layout for readability by using the `x` modifier. As per the manual: > x (`PCRE_EXTENDED`) > > If this modifier is set, whitespace data characters in the pattern are totally ignored except when escaped or inside a character class, and characters between an unescaped # outside a character class and the next newline character, inclusive, are also ignored. This is equivalent to Perl's /x modifier, and makes it possible to include commentary inside complicated patterns. > > Note, however, that this applies only to data characters. Whitespace characters may never appear within special character sequences in a pattern, for example within the sequence (?( which introduces a conditional subpattern. Reference: [https://www.php.net/manual/en/reference.pcre.pattern.modifiers.php PHP Manual: Pattern Modifiers]. This commit rewrites these two regexes to use the `x` modifier and gets rid of the unnecessary `phpcs:disable` comments. The tests in the `tests/phpunit/tests/db/dbDelta.php` file cover this change. Follow-up to https://core.trac.wordpress.org/changeset/42249. WP:Props jrf. See https://core.trac.wordpress.org/ticket/59650. --- Merges https://core.trac.wordpress.org/changeset/57056 / WordPress/wordpress-develop@13192d385f to ClassicPress. * WP-r57061: Coding Standards: Remove unnecessary ignore annotations in `dbDelta()`. It is perfectly possible to write a commented regex with layout for readability by using the `x` modifier. As per the manual: > x (`PCRE_EXTENDED`) > > If this modifier is set, whitespace data characters in the pattern are totally ignored except when escaped or inside a character class, and characters between an unescaped # outside a character class and the next newline character, inclusive, are also ignored. This is equivalent to Perl's /x modifier, and makes it possible to include commentary inside complicated patterns. > > Note, however, that this applies only to data characters. Whitespace characters may never appear within special character sequences in a pattern, for example within the sequence (?( which introduces a conditional subpattern. Reference: [https://www.php.net/manual/en/reference.pcre.pattern.modifiers.php PHP Manual: Pattern Modifiers]. This commit rewrites these two regexes to use the `x` modifier and gets rid of the unnecessary `phpcs:disable` comments. The tests in the `tests/phpunit/tests/db/dbDelta.php` file cover this change. Follow-up to https://core.trac.wordpress.org/changeset/42249. WP:Props jrf. See https://core.trac.wordpress.org/ticket/59650. --- Merges https://core.trac.wordpress.org/changeset/57061 / WordPress/wordpress-develop@0ac7b38407 to ClassicPress. * WP-r57228: KSES: Add `background-repeat` to the list of safe CSS properties. Follow-up to https://core.trac.wordpress.org/changeset/45242, https://core.trac.wordpress.org/changeset/46235. WP:Props andrewserong, ramonopoly, mukesh27. Fixes https://core.trac.wordpress.org/ticket/60132. --- Merges https://core.trac.wordpress.org/changeset/57228 / WordPress/wordpress-develop@0e28444795 to ClassicPress. * WP-r58170: Editor: add column and row spans to grid children. Adds support for setting spans using `grid-column` and `grid-row` properties on children of blocks with grid layout. WP:Props isabel_brison, andrewserong, peterwilsoncc, mukesh27. Fixes https://core.trac.wordpress.org/ticket/61111. Conflicts: - src/wp-includes/block-supports/layout.php - tests/phpunit/tests/block-supports/layout.php --- Merges https://core.trac.wordpress.org/changeset/58170 / WordPress/wordpress-develop@2b25b04f93 to ClassicPress. * WP-r58196: Docs: Add a `@since` note for the changes to `safecss_filter_attr()` in WP 6.6. Follow-up to https://core.trac.wordpress.org/changeset/58170. See https://core.trac.wordpress.org/ticket/61111. --- Merges https://core.trac.wordpress.org/changeset/58196 / WordPress/wordpress-develop@581f8d5eeb to ClassicPress. * WP-r58294: KSES: Allow leading trailing double hyphen in data attributes Expand allowable set of custom data attribute names to include those containing leading, trailing, and double `-` characters. Previously, WordPress was removing data attributes that are used in the Interactivity API. By allowing these additional custom data attributes, the related Interactivity API directives will preserve through `kses`. For example, the Interactivity API frequently relies on custom data attributes such as `data-wp-on--click="..."`. The change in https://core.trac.wordpress.org/changeset/43981 would strip these out of the processed HTML, however. Developed in WordPress/wordpress-develop#6598 Discussed in https://core.trac.wordpress.org/ticket/61052 WP:Props cbravobernal, dmsnell, gziolo, jonsurrell. Follow-up to https://core.trac.wordpress.org/changeset/43981. Fixes https://core.trac.wordpress.org/ticket/61052. Conflicts: - tests/phpunit/tests/kses.php --- Merges https://core.trac.wordpress.org/changeset/58294 / WordPress/wordpress-develop@89bec7acd8 to ClassicPress. * Fix merge conflict from 58294 * Fixes for backport test errors * WP-r58418: KSES: Preserve some additional invalid HTML comment syntaxes. When `wp_kses_split` processes a document it attempts to leave HTML comments alone. It makes minor adjustments, but leaves the comments in the document in its output. Unfortunately it only recognizes one kind of HTML comment and rejects many others. This patch makes a minor adjustment to the algorithm in `wp_kses_split` to recognize and preserve an additional kind of HTML comment: closing tags with an invalid tag name, e.g. `</%dolly>`. These invalid closing tags must be interpreted as comments by a browser. This bug fix aligns the implementation of `wp_kses_split()` more closely with its stated goal of leaving HTML comments as comments. It doesn't attempt to fully fix the mis-parsed comments, but it does propose a minor fix that hopefully won't break any existing code or projects. Developed in WordPress/wordpress-develop#6395 Discussed in https://core.trac.wordpress.org/ticket/61009 WP:Props ellatrix, dmsnell, joemcgill, jorbin, westonruter, zieladam. See https://core.trac.wordpress.org/ticket/61009. --- Merges https://core.trac.wordpress.org/changeset/58418 / WordPress/wordpress-develop@c756dfe8ca to ClassicPress. * WP-r58424: KSES: Fix tests and detection of HTML Bogus Comment spans. In https://core.trac.wordpress.org/changeset/58418 a test was added without the `test_` prefix in its function name, and because of that, it wasn't run in the test suite. The prefix has been added to ensure that it runs. In the original patch, due to a logical bug, a recursive loop to transform the inside contents of the bogus comments was never run more than once. This has been fixed. This patch also includes one more case where `kses` wasn't properly detecting the bogus comment state, and adds a test case to cover this. It limits itself to some but not all constructions of invalid markup declaration so that it doesn't conflict with existing behaviors around those and other kinds of invalid comments. WP:Props ellatrix, dmsnell. See https://core.trac.wordpress.org/ticket/61009. Follow-up to https://core.trac.wordpress.org/changeset/58418. --- Merges https://core.trac.wordpress.org/changeset/58424 / WordPress/wordpress-develop@b36ff6064a to ClassicPress. * WP-r58709: KSES: Add `opacity` to the list of safe CSS properties. Original PR from Gutenberg repository: * [WordPress/gutenberg#59891 https://core.trac.wordpress.org/ticket/59891 Update overlay step function in cover block] Reference: [https://developer.mozilla.org/en-US/docs/Web/CSS/opacity MDN Web Docs: opacity]. WP:Props sunil25393, wildworks, poena, Mamaduka, presstoke. Fixes https://core.trac.wordpress.org/ticket/61536. --- Merges https://core.trac.wordpress.org/changeset/58709 / WordPress/wordpress-develop@ad135d5f0a to ClassicPress. * WP-r59677: Formatting: Preserve `target="_blank"` in Biographical Info and Category Description. This changeset ensures the `target="_blank"` attribute is preserved when adding links in the Biographical Info and Category Description fields. Previously, this attribute was being stripped by the KSES sanitization process. Additionally, new unit tests have been added to verify the preservation of the `target="_blank"` attribute in these specific contexts. WP:Props lovewpmu, miqrogroove, bsutcliffe, sjefen6, nofearinc, nacin, harmr, blogitsolutions, stefahn, nirajgirixd, martinkrcho, spacedmonkey, sukhendu2002, audrasjb, gaellebesson, nuryko, guillaumeturpin, maximemeganck, ranafge, azaozz, joedolson, rinkalpagdar, mikinc860. Fixes https://core.trac.wordpress.org/ticket/12056. Conflicts: - tests/phpunit/tests/kses.php --- Merges https://core.trac.wordpress.org/changeset/59677 / WordPress/wordpress-develop@0f2334da81 to ClassicPress. * Fix merge conflict from 59677 * WP-r60405: Docs: Expand valid_unicode function documentation. The `valid_unicode()` function accepts a limited set of codepoints according to the XML specification. Document the allowed codepoints and link to relevant documentation. Developed in WordPress/wordpress-develop#9100. WP:Props jonsurrell, dmsnell. See https://core.trac.wordpress.org/ticket/6583, https://core.trac.wordpress.org/ticket/63166. --- Merges https://core.trac.wordpress.org/changeset/60405 / WordPress/wordpress-develop@d6355dc8d5 to ClassicPress. * WP-r60406: Coding Standards: Remove unnecessary conditional from `do_trackbacks()`. The check for a truthy `$to_ping` value is redundant, as a falsey value would cause the function to return early a few lines above. Follow-up to https://core.trac.wordpress.org/changeset/1794, https://core.trac.wordpress.org/changeset/2612. WP:Props justlevine. See https://core.trac.wordpress.org/ticket/63268. --- Merges https://core.trac.wordpress.org/changeset/60406 / WordPress/wordpress-develop@a99f57bc61 to ClassicPress. * WP-r60616: KSES: Prevent normalization from unescaping escaped numeric character references. Fixes an issue where `wp_kses_normalize_entities` would transform inputs like "&https://core.trac.wordpress.org/ticket/39;" into "&https://core.trac.wordpress.org/ticket/039;", changing the intended HTML text. This behavior has present since the initial version of KSES was introduced in https://core.trac.wordpress.org/changeset/649. https://core.trac.wordpress.org/changeset/2896 applied the normalization to post content for users without the "unfiltered_html" capability. Developed in WordPress/wordpress-develop#9099. WP:Props jonsurrell, dmsnell, sirlouen. Fixes https://core.trac.wordpress.org/ticket/63630. Conflicts: - src/wp-includes/kses.php - tests/phpunit/tests/kses.php --- Merges https://core.trac.wordpress.org/changeset/60616 / WordPress/wordpress-develop@b91b7576b8 to ClassicPress. * Fix merge conflicts from 60616 * WP-r60671: Formatting: Add 'white-space' as an allowed KSES CSS attribute. The 'white-space' attribute is safe, has wide browser support, and is useful. WP:Props sukhendu2002, mukesh27, whyisjake.. Fixes https://core.trac.wordpress.org/ticket/51707. --- Merges https://core.trac.wordpress.org/changeset/60671 / WordPress/wordpress-develop@171a547ae4 to ClassicPress. * WP-r60884: Editor: Allow popover attributes in editor content. Add attributes to KSES so that it's possible to create popover interactions natively in the editor. Adds `popovertarget`, `popovertargetaction` and `aria-haspopup` to `button`; `popover` to `div`, `ul`, and adds `dialog` with the attributes `open`, `closedby`, and `popover`. WP:Props harshdeepgill, jonsurrell, joedolson, sukhendu2002, flixos90, joedolson. Fixes https://core.trac.wordpress.org/ticket/61959. --- Merges https://core.trac.wordpress.org/changeset/60884 / WordPress/wordpress-develop@5810c47158 to ClassicPress. * WP-r60886: Editor: Add 6 missing HTML5 semantic tags (`data`, `meter`, `progress`, `search`, `time`, `wbr`) and their attributes to KSES. 1. `data` (attribute: `value`) 2. `meter` (attributes: `high`, `low`, `max`, `min`, `optimum`, `value`) 3. `progress` (attributes: `max`, `value`) 4. `search` 5. `time` (attribute: `datetime`) 6. `wbr` WP:Props ramiy, rollybueno, westonruter. Fixes https://core.trac.wordpress.org/ticket/63786. --- Merges https://core.trac.wordpress.org/changeset/60886 / WordPress/wordpress-develop@2fe26ceb7a to ClassicPress. * WP-r61017: KSES: add MathML tags. These tags are needed for the new Math block, which is included in WP 6.9. See WordPress/gutenberg#72182. See WordPress/wordpress-develop#10307. Fixes https://core.trac.wordpress.org/ticket/64115. --- Merges https://core.trac.wordpress.org/changeset/61017 / WordPress/wordpress-develop@b932ba04ef to ClassicPress. * WP-r61051: Editor: Allow `name` attribute on the `details` element in KSES. The `details` element supports the exclusive accordion behavior among multiple `details` elements by setting a common `name` attribute. The ability to set the `name` attribute in the Details block was added in of Gutenberg 20.2. However, when a user without `unfiltered_html` attempts to save the post, the `name` attribute gets erroneously stripped out. This prevents that. See [WordPress/gutenberg#56969 Details block: Exclusive accordions]. Follow-up to https://core.trac.wordpress.org/changeset/14406, https://core.trac.wordpress.org/changeset/59775. WP:Props soean. See https://core.trac.wordpress.org/ticket/12835, https://core.trac.wordpress.org/ticket/62887. Fixes https://core.trac.wordpress.org/ticket/64127. --- Merges https://core.trac.wordpress.org/changeset/61051 / WordPress/wordpress-develop@d0c86cdc8e to ClassicPress. * WP-r61436: Code Modernization: Formatting: Use null coalescing operator instead of `isset()` ternaries. Developed as a subset of WordPress/wordpress-develop#10654 Initially developed in WordPress/wordpress-develop#4886 Follow-up to https://core.trac.wordpress.org/changeset/61435, https://core.trac.wordpress.org/changeset/61434, https://core.trac.wordpress.org/changeset/61403, https://core.trac.wordpress.org/changeset/61433, https://core.trac.wordpress.org/changeset/61432, https://core.trac.wordpress.org/changeset/61431, https://core.trac.wordpress.org/changeset/61430, https://core.trac.wordpress.org/changeset/61429, https://core.trac.wordpress.org/changeset/61424, https://core.trac.wordpress.org/changeset/61404, https://core.trac.wordpress.org/changeset/61403. WP:Props costdev, westonruter. See https://core.trac.wordpress.org/ticket/58874, https://core.trac.wordpress.org/ticket/63430. --- Merges https://core.trac.wordpress.org/changeset/61436 / WordPress/wordpress-develop@6d60f73c83 to ClassicPress. * WP-r61486: Customize: Allow arbitrary CSS in global styles custom CSS. Relax Global Styles custom CSS filters to allow arbitrary CSS. Escape HTML characters `<>&` in Global Styles data to prevent it from being mangled by post content filters. The data is JSON encoded and stored in `post_content`. Filters operating on `post_content` expect it to contain HTML. Some KSES filters would otherwise remove essential CSS features like the `<custom-ident>` CSS data type because they appear to be HTML tags. https://core.trac.wordpress.org/changeset/61418 changed STYLE tag generation to use the HTML API for improved safety. Developed in WordPress/wordpress-develop#10641. WP:Props jonsurrell, dmsnell, westonruter, ramonopoly, oandregal, jorgefilipecosta, sabernhardt, soyebsalar01. See https://core.trac.wordpress.org/ticket/64418. Conflicts: - src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php - tests/phpunit/tests/rest-api/rest-global-styles-controller.php --- Merges https://core.trac.wordpress.org/changeset/61486 / WordPress/wordpress-develop@101a21f4f4 to ClassicPress. * WP-r61565: Editor: screen size based block visibility support. Adds ability to hide blocks at different screen sizes to the block visibility support. WP:Props ramonopoly, isabel_brison, westonruter. Closes https://core.trac.wordpress.org/ticket/64414. Conflicts: - src/wp-includes/block-supports/block-visibility.php - tests/phpunit/tests/block-supports/block-visibility.php --- Merges https://core.trac.wordpress.org/changeset/61565 / WordPress/wordpress-develop@5885cb96a9 to ClassicPress. * WP-r61882: KSES: Optimize PCRE pattern detecting numeric character references. WP:Props dmsnell, xknown, johnbillion. --- Merges https://core.trac.wordpress.org/changeset/61882 / WordPress/wordpress-develop@695c31e4cb to ClassicPress. * WP-r62530: KSES: Allow SVG presentation attributes in safe_style_css. Add SVG presentation attributes to the list of CSS properties allowed by `safecss_filter_attr()`, so inline SVG markup can be styled via the `style` attribute. This ports Gutenberg PR https://core.trac.wordpress.org/ticket/79172 to Core. WP:Props afercia, westonruter, wildworks. Fixes https://core.trac.wordpress.org/ticket/65457. --- Merges https://core.trac.wordpress.org/changeset/62530 / WordPress/wordpress-develop@e904e28cdd to ClassicPress. * WP-r62531: KSES: Add command and commandfor to the list of allowed attributes for buttons. Developed in: WordPress/wordpress-develop#11483 WP:Props pratiknawkar94, joedolson, westonruter, afercia. Fixes https://core.trac.wordpress.org/ticket/64576. --- Merges https://core.trac.wordpress.org/changeset/62531 / WordPress/wordpress-develop@e3c26545b1 to ClassicPress. * Use available test assertion for 62531 * WP-r62550: Code Modernization: Use `array_any()` where appropriate. This commit replaces several `foreach` loops that iterate an array, return `true` as soon as an element matches a condition, and otherwise fall through to `false`. That is exactly what PHP 8.4's `array_any()` expresses in a single, more readable call. WordPress core includes a polyfill for `array_any()` on PHP < 8.4 as of WordPress 6.8, so the change works on every supported PHP version without raising the minimum requirement. Follow-up to https://core.trac.wordpress.org/changeset/59783. WP:Props Soean, mukesh27, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/65519. Conflicts: - src/wp-includes/block-template-utils.php - src/wp-includes/class-wp-block-processor.php --- Merges https://core.trac.wordpress.org/changeset/62550 / WordPress/wordpress-develop@a1314bbebc to ClassicPress. * WP-r62699: Coding Standards: Use `in_array()` instead of `array_search()` for existence checks. Several places in core use `array_search()` purely to determine whether a value exists in an array, comparing the result against `false`. In these cases the returned key/position is never used, so `in_array()` expresses the intent more clearly and avoids computing a return value that is discarded. This commit replaces those existence-only `array_search()` calls with `in_array()`. The strict (`true`) comparison flag is preserved in every case, so there is no change in behavior. WP:Props Soean. See https://core.trac.wordpress.org/ticket/64897. --- Merges https://core.trac.wordpress.org/changeset/62699 / WordPress/wordpress-develop@eb881494d9 to ClassicPress. * WP-r62708: KSES: Add `tabindex` to the list of allowed global attributes. Add `tabindex` to the list of global attributes allowed by `_wp_add_global_attributes()`, so it survives KSES filtering on any element that supports global attributes. Developed in: WordPress/wordpress-develop#12493 WP:Props ramonopoly, wildworks. Fixes https://core.trac.wordpress.org/ticket/65619. --- Merges https://core.trac.wordpress.org/changeset/62708 / WordPress/wordpress-develop@d6f6780a5a to ClassicPress. * WP-r62718: Block Supports: Add background gradient support that can combine with background image Adds `background.gradient` as a new block support, enabling blocks to combine a background gradient with a background image via comma-separated `background-image` CSS values (e.g., `background-image: linear-gradient(...), url(...)`). Before, the only way to apply a gradient is through `color.gradient`, which renders as a `background` CSS shorthand and conflicts with background image properties. By introducing `background.gradient` (stored at `style.background.gradient`), gradients become part of the background style group, allowing the style engine to combine gradient and image values without conflict. WP:Props aaronrobertshaw, ramonopoly, wildworks. Fixes https://core.trac.wordpress.org/ticket/64974. Conflicts: - src/wp-includes/block-supports/background.php - src/wp-includes/block-supports/colors.php - src/wp-includes/class-wp-theme-json.php - src/wp-includes/style-engine/class-wp-style-engine.php - tests/phpunit/tests/block-supports/colors.php - tests/phpunit/tests/block-supports/wpRenderBackgroundSupport.php - tests/phpunit/tests/style-engine/styleEngine.php - tests/phpunit/tests/theme/wpThemeJson.php --- Merges https://core.trac.wordpress.org/changeset/62718 / WordPress/wordpress-develop@6b190c64b2 to ClassicPress. * WP-r62850: KSES: Allow the autofocus attribute on dialog elements. First step to allow the usage of the autofocus attribute for native dialog elements. More work will follow to add a context-aware mechanism to KSES and allow the attribute on dialog element children. WP:Props westonruter, joedolson, mukesh27, afercia. Fixes https://core.trac.wordpress.org/ticket/65491. --- Merges https://core.trac.wordpress.org/changeset/62850 / WordPress/wordpress-develop@05d3b3cec4 to ClassicPress. * Use available test assertion for 62850 * WP-r63180: KSES: Allow functional CSS values in inline styles. The presentation properties allowlisted in https://core.trac.wordpress.org/changeset/62530 were accepted in name only: any declaration whose value contained a function call was dropped in full, so for users without the `unfiltered_html` capability those properties remained unusable in their canonical form. URL references are routed through the existing protocol validation, so the security model is unchanged. Developed in: WordPress/wordpress-develop#12942 Follow-up to https://core.trac.wordpress.org/changeset/62530. WP:Props courane01, hasnainashfaq, irozum, khokansardar, mdridipu, tyxla. Fixes https://core.trac.wordpress.org/ticket/65832. --- Merges https://core.trac.wordpress.org/changeset/63180 / WordPress/wordpress-develop@996c6d6864 to ClassicPress. * WP-r63320: Docs: Remove a blank line between `@param` and `@return` in core docblocks. The [https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/ PHP inline documentation standards] place `@return` immediately after the last `@param` tag, with no blank line between them: {{{ /** * Summary. * * @SInCE x.x.x * * @PARAM string $var Description. * @return string Description. */ }}} This corrects 44 docblocks across 33 files in `src/wp-includes` that used a line break between the two tags. Developed in WordPress/wordpress-develop#13063. WP:Props mukesh27, dhruvang21. See https://core.trac.wordpress.org/ticket/65818, https://core.trac.wordpress.org/ticket/65860. Conflicts: - src/wp-includes/block-editor.php - src/wp-includes/block-supports/aria-label.php - src/wp-includes/block-supports/block-style-variations.php - src/wp-includes/block-supports/colors.php - src/wp-includes/block-supports/custom-classname.php - src/wp-includes/block-supports/settings.php - src/wp-includes/block-supports/utils.php - src/wp-includes/block-template-utils.php - src/wp-includes/block-template.php - src/wp-includes/blocks.php - src/wp-includes/class-wp-block-type.php - src/wp-includes/class-wp-textdomain-registry.php - src/wp-includes/class-wp-theme-json-data.php - src/wp-includes/class-wp-theme-json-schema.php - src/wp-includes/class-wp-token-map.php - src/wp-includes/deprecated.php - src/wp-includes/functions.php - src/wp-includes/global-styles-and-settings.php - src/wp-includes/html-api/class-wp-html-doctype-info.php - src/wp-includes/html-api/class-wp-html-processor.php - src/wp-includes/html-api/class-wp-html-tag-processor.php - src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php - src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php - src/wp-includes/theme.php - src/wp-includes/user.php --- Merges https://core.trac.wordpress.org/changeset/63320 / WordPress/wordpress-develop@728a605348 to ClassicPress. * WP-r63910: KSES: Allow CSS anchor position properties. Adds CSS anchoring properties to the `safecss_filter_attr()` allow list: * `anchor-name` * `anchor-scope` * `position-anchor` * `position-area` * `position-try` * `position-try-fallbacks` * `position-try-order` * `position-visibility` WP:Props deepakprajapati, wildworks, adrianduffell, dannyreaktiv, im3dabasia1, westonruter. Fixes https://core.trac.wordpress.org/ticket/64972. --- Merges https://core.trac.wordpress.org/changeset/63910 / WordPress/wordpress-develop@6b08132f3f to ClassicPress. * Delete shadow.php - not needed --------- Co-authored-by: Sergey Biryukov <sergeybiryukov@git.wordpress.org> Co-authored-by: Peter Wilson <peterwilsoncc@git.wordpress.org> Co-authored-by: Isabel Brison <isabel_brison@git.wordpress.org> Co-authored-by: Jb Audras <audrasjb@git.wordpress.org> Co-authored-by: Colin Stewart <costdev@git.wordpress.org> Co-authored-by: Dennis Snell <dmsnell@git.wordpress.org> Co-authored-by: Jon Surrell <jonsurrell@git.wordpress.org> Co-authored-by: Timothy Jacobs <timothyblynjacobs@git.wordpress.org> Co-authored-by: Joe Dolson <joedolson@git.wordpress.org> Co-authored-by: Weston Ruter <westonruter@git.wordpress.org> Co-authored-by: Ella Van Durpe <ellatrix@git.wordpress.org> Co-authored-by: John Blackbourn <johnbillion@git.wordpress.org> Co-authored-by: Aki Hamano <wildworks@git.wordpress.org> Co-authored-by: Andrea Fercia <afercia@git.wordpress.org> Co-authored-by: ramonopoly <ramonopoly@git.wordpress.org> CP:Props: mattyrob, xxsimoxx

Replace the invalid comment closer as well.

0601582

adamziel reviewed Apr 16, 2024

View reviewed changes

Comment thread src/wp-includes/kses.php Outdated

adamziel mentioned this pull request Apr 16, 2024

Auto-post a Playground preview link on every PR WordPress/gutenberg#60795

Closed

Remove kses test verifying guard against IE conditional comments.

fd66dda

dmsnell mentioned this pull request Jun 7, 2024

Add prefix / suffix to Post Date block WordPress/gutenberg#61920

Open

dmsnell added 2 commits June 12, 2024 15:54

Ensure PCRE pattern matches full string match.

e0e36b0

Run comment content through kses

cc39a88

dmsnell force-pushed the html-api/allow-storing-funky-comments branch from d18593b to cc39a88 Compare June 12, 2024 13:55

dmsnell added 3 commits June 12, 2024 16:01

Bring invalid test back, update the expected output.

5eacbc3

Remove additional fix.

7c44482

Remove other fixes.

b60d0e0

ellatrix reviewed Jun 12, 2024

View reviewed changes

Remove other fix, update docs.

8a31702

PCRE pattern cleanup.

5dbbe50

dmsnell commented Jun 12, 2024

View reviewed changes

ellatrix approved these changes Jun 12, 2024

View reviewed changes

ellatrix reviewed Jun 12, 2024

View reviewed changes

Update @SInCE tags

dca7d00

westonruter approved these changes Jun 12, 2024

View reviewed changes

adamziel reviewed Jun 12, 2024

View reviewed changes

adamziel approved these changes Jun 12, 2024

View reviewed changes

Add a basic unit test to prevent regressions.

5949d4c

dmsnell force-pushed the html-api/allow-storing-funky-comments branch from 6c708fb to 5949d4c Compare June 12, 2024 20:19

Merge branch 'trunk' into html-api/allow-storing-funky-comments

5ae60b3

dmsnell closed this Jun 15, 2024

dmsnell deleted the html-api/allow-storing-funky-comments branch June 15, 2024 06:33

Conversation

dmsnell commented Apr 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Status

Description

Discussion

Uh oh!

github-actions Bot commented Apr 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2024

Test using WordPress Playground

Some things to be aware of

Uh oh!

adamziel commented Apr 16, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

adamziel commented Apr 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

westonruter commented Apr 16, 2024

Uh oh!

dmsnell commented Apr 17, 2024

Uh oh!

westonruter commented Apr 17, 2024

Uh oh!

dmsnell commented Apr 18, 2024

Uh oh!

dmsnell commented Apr 19, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ellatrix commented Jun 12, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ellatrix left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ellatrix left a comment

Choose a reason for hiding this comment

Uh oh!

dmsnell commented Jun 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

westonruter left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adamziel Jun 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adamziel left a comment

Choose a reason for hiding this comment

Uh oh!

dmsnell commented Jun 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

dmsnell commented Apr 15, 2024 •

edited

Loading

github-actions Bot commented Apr 15, 2024 •

edited

Loading

adamziel commented Apr 16, 2024 •

edited

Loading

ellatrix left a comment •

edited

Loading

dmsnell commented Jun 12, 2024 •

edited

Loading

adamziel Jun 12, 2024 •

edited

Loading

dmsnell commented Jun 15, 2024 •

edited

Loading