Changeset 43781 for branches/5.0/src/wp-includes/kses.php

Timestamp:

10/22/2018 04:03:07 AM (8 years ago)

Author:

pento

Message:

KSES: Allow url() to be used in inline CSS.

The cover image block uses the url() function in its inline CSS, to show the cover image. KSES didn't allow this, causing the block to not save correctly for Author and Contributor users. As KSES does already check each attribute name against an allowed list, we're able to add an extra check for certain attributes to be able to use the url() function, too.

Props peterwilsoncc, azaozz, pento, dd32.
See #45067.

File:

• branches/5.0/src/wp-includes/kses.php (modified) (4 diffs)

branches/5.0/src/wp-includes/kses.php

@@ -1708 +1708 @@
  */
 function safecss_filter_attr( $css, $deprecated = '' ) {
-        if ( !empty( $deprecated ) )
+        if ( ! empty( $deprecated ) ) {
                 _deprecated_argument( __FUNCTION__, '2.8.1' ); // Never implemented
-
-        $css = wp_kses_no_null($css);
-        $css = str_replace(array("\n","\r","\t"), '', $css);
-
-        if ( preg_match( '%[\\\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
-                return '';
+        }
+
+        $css = wp_kses_no_null( $css );
+        $css = str_replace( array( "\n", "\r", "\t" ), '', $css );
+
+        $allowed_protocols = wp_allowed_protocols();
 
         $css_array = explode( ';', trim( $css ) );
@@ -1725 +1725 @@
          * @since 4.4.0 Added support for `min-height`, `max-height`, `min-width`, and `max-width`.
          * @since 4.6.0 Added support for `list-style-type`.
+         * @since 5.0.0 Added support for `background-image`.
          *
          * @param array $attr List of allowed CSS attributes.
@@ -1731 +1732 @@
                 'background',
                 'background-color',
+                'background-image',
 
                 'border',
@@ -1799 +1801 @@
         ) );
 
-        if ( empty($allowed_attr) )
+
+        /*
+         * CSS attributes that accept URL data types.
+         *
+         * This is in accordance to the CSS spec and unrelated to
+         * the sub-set of supported attributes above.
+         *
+         * See: https://developer.mozilla.org/en-US/docs/Web/CSS/url
+         */
+        $css_url_data_types = array(
+                'background',
+                'background-image',
+
+                'cursor',
+
+                'list-style',
+                'list-style-image',
+        );
+
+        if ( empty( $allowed_attr ) ) {
                 return $css;
+        }
 
         $css = '';
         foreach ( $css_array as $css_item ) {
-                if ( $css_item == '' )
+                if ( $css_item == '' ) {
                         continue;
-                $css_item = trim( $css_item );
-                $found = false;
+                }
+
+                $css_item        = trim( $css_item );
+                $css_test_string = $css_item;
+                $found           = false;
+                $url_attr        = false;
+
                 if ( strpos( $css_item, ':' ) === false ) {
                         $found = true;
                 } else {
-                        $parts = explode( ':', $css_item );
-                        if ( in_array( trim( $parts[0] ), $allowed_attr ) )
+                        $parts = explode( ':', $css_item, 2 );
+                        $css_selector = trim( $parts[0] );
+
+                        if ( in_array( $css_selector, $allowed_attr, true ) ) {
                                 $found = true;
+                                $url_attr = in_array( $css_selector, $css_url_data_types, true );
+                        }
                 }
-                if ( $found ) {
-                        if( $css != '' )
+
+                if ( $found && $url_attr ) {
+                        // Simplified: matches the sequence `url(*)`.
+                        preg_match_all( '/url\([^)]+\)/', $parts[1], $url_matches );
+
+                        foreach ( $url_matches[0] as $url_match ) {
+                                // Clean up the URL from each of the matches above.
+                                preg_match( '/^url\(\s*([\'\"]?)(.*)(\g1)\s*\)$/', $url_match, $url_pieces );
+
+                                if ( empty( $url_pieces[2] ) ) {
+                                        $found = false;
+                                        break;
+                                }
+
+                                $url = trim( $url_pieces[2] );
+
+                                if ( empty( $url ) || $url !== wp_kses_bad_protocol( $url, $allowed_protocols ) ) {
+                                        $found = false;
+                                        break;
+                                } else {
+                                        // Remove the whole `url(*)` bit that was matched above from the CSS.
+                                        $css_test_string = str_replace( $url_match, '', $css_test_string );
+                                }
+                        }
+                }
+
+                // Remove any CSS containing containing \ ( & } = or comments, except for url() useage checked above.
+                if ( $found && ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string ) ) {
+                        if ( $css != '' ) {
                                 $css .= ';';
+                        }
+
                         $css .= $css_item;
                 }