Ticket #55966: 55966.diff

src/wp-includes/kses.php

@@ -2467 +2467 @@
                 }
 
                 if ( $found ) {
-                        // Allow CSS calc().
-                        $css_test_string = preg_replace( '/calc\(((?:\([^()]*\)?|[^()])*)\)/', '', $css_test_string );
+                        // Allow some CSS functions.
+                        $css_test_string = preg_replace( '/\b(?:calc|min|max|minmax|clamp)\(((?:\([^()]*\)?|[^()])*)\)/', '', $css_test_string );
+
                         // Allow CSS var().
                         $css_test_string = preg_replace( '/\(?var\(--[a-zA-Z0-9_-]*\)/', '', $css_test_string );
 

tests/phpunit/tests/kses.php

@@ -1120 +1120 @@
                                 'css'      => 'color: rgb( 100, 100, 100, .4 )',
                                 'expected' => '',
                         ),
+                        // Allow min().
+                        array(
+                                'width: min(50%, 400px)',
+                                'width: min(50%, 400px)',
+                        ),
+                        // Allow max().
+                        array(
+                                'width: max(50%, 40rem)',
+                                'width: max(50%, 40rem)',
+                        ),
+                        // Allow minmax().
+                        array(
+                                'width: minmax(100px, 50%)',
+                                'width: minmax(100px, 50%)',
+                        ),
+                        // Allow clamp().
+                        array(
+                                'width: clamp(100px, 50%, 100vw)',
+                                'width: clamp(100px, 50%, 100vw)',
+                        ),
+                        // Combined CSS function names.
+                        array(
+                                'width: calcmax(100px + 50%)',
+                                '',
+                        ),
+                        // Allow calc().
+                        array(
+                                'width: calc(2em + 3px)',
+                                'width: calc(2em + 3px)',
+                        ),
+                        // Allow var().
+                        array(
+                                'padding: var(--wp-var1) var(--wp-var2)',
+                                'padding: var(--wp-var1) var(--wp-var2)',
+                        ),
+                        // Allow calc() with var().
+                        array(
+                                'margin-top: calc(var(--wp-var1) * 3 + 2em)',
+                                'margin-top: calc(var(--wp-var1) * 3 + 2em)',
+                        ),
+                        // Malformed min, no closing `)`.
+                        array(
+                                'width: min(3em + 10px',
+                                '',
+                        ),
+                        // Malformed max, no closing `)`.
+                        array(
+                                'width: max(3em + 10px',
+                                '',
+                        ),
+                        // Malformed minmax, no closing `)`.
+                        array(
+                                'width: minmax(3em + 10px',
+                                '',
+                        ),
+                        // Malformed calc, no closing `)`.
+                        array(
+                                'width: calc(3em + 10px',
+                                '',
+                        ),
+                        // Malformed var, no closing `)`.
+                        array(
+                                'width: var(--wp-var1',
+                                '',
+                        ),
                 );
         }
 
@@ -1226 +1291 @@
          * @ticket 45067
          * @ticket 46197
          * @ticket 46498
+         * @ticket 55966
          *
          * @param $input string The style attribute saved in the editor.
          * @param $expected string The sanitized style attribute.
@@ -1301 +1367 @@
                                 'background: red',
                         ),
 
-                        // CSS calc().
-                        array(
-                                'width: calc(2em + 3px)',
-                                'width: calc(2em + 3px)',
-                        ),
-
-                        // CSS variable.
-                        array(
-                                'padding: var(--wp-var1) var(--wp-var2)',
-                                'padding: var(--wp-var1) var(--wp-var2)',
-                        ),
-
-                        // CSS calc() with var().
-                        array(
-                                'margin-top: calc(var(--wp-var1) * 3 + 2em)',
-                                'margin-top: calc(var(--wp-var1) * 3 + 2em)',
-                        ),
-
                         /*
                          * Invalid use cases.
                          */
@@ -1382 +1430 @@
                                 'background-image: url( "http://example.com );',
                                 '',
                         ),
-
-                        // Malformed calc, no closing `)`.
-                        array(
-                                'width: calc(3em + 10px',
-                                '',
-                        ),
-
-                        // Malformed var, no closing `)`.
-                        array(
-                                'width: var(--wp-var1',
-                                '',
-                        ),
                 );
         }