Ticket #37134: 37134.8.diff

src/wp-includes/kses.php

@@ -2301 +2301 @@
                         }
                 }
 
-                if ( $found ) {
-                        /**
-                         * Filters the regex limiting the list of characters not allowed in CSS rules.
-                         *
-                         * Default behaviour is to remove any CSS containing \ ( & } = or comments,
-                         * except for url() usage.
-                         *
-                         * @since 5.5.0
-                         *
-                         * @param string $regex           Regex pattern of disallowed characters in CSS rules.
-                         *                                Default is '%[\\\(&=}]|/\*%'.
-                         * @param string $css_test_string CSS value to test.
-                         */
-                        $disallowed_chars = apply_filters( 'safe_style_disallowed_chars', '%[\\\(&=}]|/\*%', $css_test_string );
-                        if ( ! preg_match( $disallowed_chars, $css_test_string ) ) {
-                                if ( '' !== $css ) {
-                                        $css .= ';';
-                                }
-                                $css .= $css_item;
+                // Check for any CSS containing \ ( & } = or comments, except for url() usage checked above.
+                $unsafe_css_found = (bool) preg_match( '%[\\\(&=}]|/\*%', $css_test_string );
+
+                /**
+                 * Filters the check for unsafe CSS in `safecss_filter_attr`.
+                 *
+                 * Enables developers to filter the value that determines whether a section of CSS part disallowed characters.
+                 *
+                 * By default, the value will be true if the part contains \ ( & } = or comments. Return true to allow the part to
+                 * be included in the output.
+                 *
+                 * @param bool   $unsafe_css_found Whether unsafe CSS is found in the test string.
+                 * @param string $css_test_string  The css string to test.
+                 */
+                $unsafe_css_found = apply_filters( 'safe_style_css_has_unsafe_css', $unsafe_css_found, $css_test_string );
+
+                 // Only add the css part if it passes the regex check.
+                if ( $found && ! $unsafe_css_found ) {
+                        if ( '' !== $css ) {
+                                $css .= ';';
                         }
+
+                        $css .= $css_item;
                 }
         }
 

tests/phpunit/tests/kses.php

@@ -1262 +1262 @@
                 );
         }
 
-        /**
-         * Filter for disallowed characters never matches thus allowing all characters.
-         */
-        function _safe_style_disallowed_chars_filter( $regex ) {
-                return '%a^%'; // Regex with no matches.
-
-        }
         /**
          * Testing the safecss_filter_attr() function with the safe_style_disallowed_chars filter.
          *
@@ -1280 +1273 @@
          * @param string $expected Expected string of CSS rules.
          */
         public function test_safecss_filter_attr_filtered( $css, $expected ) {
-                add_filter( 'safe_style_disallowed_chars', array( $this, '_safe_style_disallowed_chars_filter' ) );
+                add_filter( 'safe_style_css_has_disallowed_chars', '__return_false' );
                 $this->assertSame( $expected, safecss_filter_attr( $css ) );
-                remove_filter( 'safe_style_disallowed_chars', array( $this, '_safe_style_disallowed_chars_filter' ) );
+                remove_filter( 'safe_style_css_has_disallowed_chars', '__return_false' );
         }
 
         /**