Ticket #39724: 39724.patch

src/wp-includes/kses.php

@@ -827 +827 @@
         if (preg_match('%\s*/\s*$%', $attr))
                 $xhtml_slash = ' /';
 
-        // Are any attributes allowed at all for this element?
-        if ( ! isset($allowed_html[strtolower($element)]) || count($allowed_html[strtolower($element)]) == 0 )
-                return "<$element$xhtml_slash>";
-
-        // Split it
-        $attrarr = wp_kses_hair($attr, $allowed_protocols);
-
-        // Go through $attrarr, and save the allowed attributes for this element
-        // in $attr2
-        $attr2 = '';
-        foreach ( $attrarr as $arreach ) {
-                if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) {
-                        $attr2 .= ' '.$arreach['whole'];
+        /**
+         * Custom function per tag value. The callback takes ($element, $attr) as arguments.
+         */
+        if ( is_callable( $allowed_html[strtolower($element)] ) ) {
+                $attr2 = call_user_func( $allowed_html[strtolower($element)], $element, $attr );
+        }
+        else {
+                
+                // Are any attributes allowed at all for this element?
+                if ( ! isset($allowed_html[strtolower($element)]) || count($allowed_html[strtolower($element)]) == 0 )
+                        return "<$element$xhtml_slash>";
+        
+                // Split it
+                $attrarr = wp_kses_hair($attr, $allowed_protocols);
+        
+                // Go through $attrarr, and save the allowed attributes for this element
+                // in $attr2
+                $attr2 = '';
+                foreach ( $attrarr as $arreach ) {
+                        if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) {
+                                $attr2 .= ' '.$arreach['whole'];
+                        }
                 }
         }
 
@@ -871 +880 @@
                 return false;
         }
 
+        /**
+         * Custom function per attribute value. The callback takes ($name, $value, $element) as arguments.
+         */
+        if ( is_callable( $allowed_attr[$name_low] ) ) {
+                $new_value = call_user_func( $allowed_attr[$name_low], $name, $value, $element );
+                if ( empty( $new_value ) ) {
+                        $name = $value = $whole = '';
+                        return false;
+                }
+                return true;
+        }
+
         if ( 'style' == $name_low ) {
                 $new_value = safecss_filter_attr( $value );
 

tests/phpunit/tests/kses.php

@@ -678 +678 @@
 
                 $this->assertEquals( $input, wp_kses( $input, $allowedposttags ) );
         }
+        
+        /**
+         * @ticket 39724
+         */
+        function test_wp_kses_attr_check_custom() {
+                add_filter( 'wp_kses_allowed_html', array( $this, '_wp_kses_allowed_html_custom_filter' ), 10, 2 );
+                
+                $input = '<span foo="bar" style="color: rgb(100,100,100);" enable data-test="foo">text</span>';
+                $this->assertEquals('<span style="color: rgb(100,100,100);" enable data-test="foo">text</span>', wp_kses( $input, '' ) );
+
+                $input = '<iframe src=""></iframe>';
+                $this->assertEquals('<iframe src="" disabled></iframe>', wp_kses( $input, '' ) );
+                
+                remove_filter( 'wp_kses_allowed_html', array( $this, '_wp_kses_allowed_html_custom_filter' ), 10, 2 );
+        }
+        
+        function _wp_kses_allowed_html_custom_filter ( $tags, $context ) {
+                // span attributes settings
+                $tags['span']['enable'] = 1;
+                $tags['span']['data-test'] = 1;
+                $tags['span']['style'] = function ( $name, $value, $element ) { 
+                        return $value;
+                };
+
+                // iframe callback
+                $tags['iframe'] = function ( $element, $attr ) { 
+                        return $attr . ' disabled';
+                };
+
+                return $tags;
+        }
 }