Skip to content

Commit be94129

Browse files
committed
KSES: Allow functional CSS values in inline styles.
The presentation properties allowlisted in [62530] were accepted in name only: any declaration whose value contained a function call was dropped in full, so for users without the `unfiltered_html` capability those properties remained unusable in their canonical form. URL references are routed through the existing protocol validation, so the security model is unchanged. Developed in: WordPress/wordpress-develop#12942 Follow-up to [62530]. Props courane01, hasnainashfaq, irozum, khokansardar, mdridipu, tyxla. Fixes #65832. Built from https://develop.svn.wordpress.org/trunk@63180 git-svn-id: http://core.svn.wordpress.org/trunk@62377 1a063a9b-81f0-0310-95a4-ce76da25c4cd
1 parent 0246354 commit be94129

2 files changed

Lines changed: 25 additions & 2 deletions

File tree

‎wp-includes/kses.php‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2638,6 +2638,8 @@ function kses_init() {
26382638
* @since 6.6.0 Added support for `grid-column`, `grid-row`, and `container-type`.
26392639
* @since 6.9.0 Added support for `white-space`.
26402640
* @since 7.1.0 Extended gradient support to allow any single-level nested function.
2641+
* Added support for transform functions, `clip-path` basic shapes,
2642+
* and URLs in the SVG element reference properties.
26412643
*
26422644
* @param string $css A string of CSS rules, decoded from an HTML `style` attribute.
26432645
* @param string $deprecated Not used.
@@ -2906,6 +2908,16 @@ function safecss_filter_attr( $css, $deprecated = '' ) {
29062908

29072909
'list-style',
29082910
'list-style-image',
2911+
2912+
// SVG presentation properties that accept url() references.
2913+
'clip-path',
2914+
'fill',
2915+
'marker',
2916+
'marker-end',
2917+
'marker-mid',
2918+
'marker-start',
2919+
'mask',
2920+
'stroke',
29092921
);
29102922

29112923
/*
@@ -3004,7 +3016,18 @@ function safecss_filter_attr( $css, $deprecated = '' ) {
30043016
* Nested functions and parentheses are also removed, so long as the parentheses are balanced.
30053017
*/
30063018
$css_test_string = preg_replace(
3007-
'/\b(?:var|calc|min|max|minmax|clamp|repeat)(\((?:[^()]|(?1))*\))/',
3019+
'/\b(?:'
3020+
// General purpose value functions.
3021+
. 'var|calc|min|max|minmax|clamp|repeat'
3022+
// Transform functions.
3023+
. '|matrix|matrix3d|perspective'
3024+
. '|rotate|rotate3d|rotateX|rotateY|rotateZ'
3025+
. '|scale|scale3d|scaleX|scaleY|scaleZ'
3026+
. '|skew|skewX|skewY'
3027+
. '|translate|translate3d|translateX|translateY|translateZ'
3028+
// Basic shape functions, as used by `clip-path`.
3029+
. '|circle|ellipse|inset|path|polygon|rect|shape|xywh'
3030+
. ')(\((?:[^()]|(?1))*\))/',
30083031
'',
30093032
$css_test_string
30103033
);

‎wp-includes/version.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
*
1717
* @global string $wp_version
1818
*/
19-
$wp_version = '7.2-alpha-63179';
19+
$wp_version = '7.2-alpha-63180';
2020

2121
/**
2222
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

0 commit comments

Comments
 (0)