Changeset 43981

Timestamp:

12/12/2018 02:38:14 AM (6 years ago)

Author:

jeremyfelt

Message:

KSES: Allow HTML data-* attributes.

Add global support for HTML attributes prefixed data- for authors and contributors, as required by the new editor.

Merges [43727] to trunk.

Props azaozz, peterwilsoncc.
Fixes #33121.

Location:

trunk

Files:

• . (modified) (1 prop)
• src/wp-includes/kses.php (modified) (4 diffs)
• tests/phpunit/tests/kses.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-attachments-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-posts-controller.php (modified) (1 diff)

trunk/src/wp-includes/kses.php

@@ -1077 +1077 @@
  *
  * @since 4.2.3
+ * @since 5.0.0 Add support for `data-*` wildcard attributes.
  *
  * @param string $name         The attribute name. Passed by reference. Returns empty string when not allowed.
@@ -1091 +1092 @@
     $name_low = strtolower( $name );
     if ( ! isset( $allowed_attr[ $name_low ] ) || '' == $allowed_attr[ $name_low ] ) {
-        $name = $value = $whole = '';
-        return false;
+        /*
+         * Allow `data-*` attributes.
+         *
+         * When specifying `$allowed_html`, the attribute name should be set as
+         * `data-*` (not to be mixed with the HTML 4.0 `data` attribute, see
+         * https://www.w3.org/TR/html40/struct/objects.html#adef-data).
+         *
+         * Note: the attribute name should only contain `A-Za-z0-9_-` chars,
+         * double hyphens `--` are not accepted by WordPress.
+         */
+        if ( strpos( $name_low, 'data-' ) === 0 && ! empty( $allowed_attr['data-*'] ) && preg_match( '/^data(?:-[a-z0-9_]+)+$/', $name_low, $match ) ) {
+            /*
+             * Add the whole attribute name to the allowed attributes and set any restrictions
+             * for the `data-*` attribute values for the current element.
+             */
+            $allowed_attr[ $match[0] ] = $allowed_attr['data-*'];
+        } else {
+            $name = $value = $whole = '';
+            return false;
+        }
     }
 
@@ -2092 +2111 @@
  *
  * @since 3.5.0
+ * @since 5.0.0 Add support for `data-*` wildcard attributes.
  * @access private
  * @ignore
@@ -2100 +2120 @@
 function _wp_add_global_attributes( $value ) {
     $global_attributes = array(
-        'class' => true,
-        'id'    => true,
-        'style' => true,
-        'title' => true,
-        'role'  => true,
+        'class'  => true,
+        'id'     => true,
+        'style'  => true,
+        'title'  => true,
+        'role'   => true,
+        'data-*' => true,
     );
 

trunk/tests/phpunit/tests/kses.php

@@ -826 +826 @@
         );
     }
+
+    /**
+     * Data attributes are globally accepted.
+     *
+     * @ticket 33121
+     */
+    function test_wp_kses_attr_data_attribute_is_allowed() {
+        $test     = '<div data-foo="foo" data-bar="bar" datainvalid="gone" data--invaild="gone"  data-also-invaild-="gone" data-two-hyphens="remains">Pens and pencils</div>';
+        $expected = '<div data-foo="foo" data-bar="bar" data-two-hyphens="remains">Pens and pencils</div>';
+
+        $this->assertEquals( $expected, wp_kses_post( $test ) );
+    }
+
+    /**
+     * Ensure wildcard attributes block unprefixed wildcard uses.
+     *
+     * @ticket 33121
+     */
+    function test_wildcard_requires_hyphen_after_prefix() {
+        $allowed_html = array(
+            'div' => array(
+                'data-*' => true,
+                'on-*'   => true,
+            ),
+        );
+
+        $string   = '<div datamelformed-prefix="gone" data="gone" data-="gone" onclick="alert(1)">Malformed attributes</div>';
+        $expected = '<div>Malformed attributes</div>';
+
+        $actual = wp_kses( $string, $allowed_html );
+
+        $this->assertSame( $expected, $actual );
+    }
+
+    /**
+     * Ensure wildcard allows two hyphen.
+     *
+     * @ticket 33121
+     */
+    function test_wildcard_allows_two_hyphens() {
+        $allowed_html = array(
+            'div' => array(
+                'data-*' => true,
+            ),
+        );
+
+        $string   = '<div data-wp-id="pens-and-pencils">Well formed attribute</div>';
+        $expected = '<div data-wp-id="pens-and-pencils">Well formed attribute</div>';
+
+        $actual = wp_kses( $string, $allowed_html );
+
+        $this->assertSame( $expected, $actual );
+    }
+
+    /**
+     * Ensure wildcard attributes only support valid prefixes.
+     *
+     * @dataProvider data_wildcard_attribute_prefixes
+     *
+     * @ticket 33121
+     */
+    function test_wildcard_attribute_prefixes( $wildcard_attribute, $expected ) {
+        $allowed_html = array(
+            'div' => array(
+                $wildcard_attribute => true,
+            ),
+        );
+
+        $name  = str_replace( '*', strtolower( __FUNCTION__ ), $wildcard_attribute );
+        $value = __FUNCTION__;
+        $whole = "{$name}=\"{$value}\"";
+
+        $actual = wp_kses_attr_check( $name, $value, $whole, 'n', 'div', $allowed_html );
+
+        $this->assertSame( $expected, $actual );
+    }
+
+    /**
+     * @return array Array of arguments for wildcard testing
+     *               [0] The prefix being tested.
+     *               [1] The outcome of `wp_kses_attr_check` for the prefix.
+     */
+    function data_wildcard_attribute_prefixes() {
+        return array(
+            // Ends correctly
+            array( 'data-*', true ),
+
+            // Does not end with trialing `-`.
+            array( 'data*', false ),
+
+            // Multiple wildcards.
+            array( 'd*ta-*', false ),
+            array( 'data**', false ),
+        );
+    }
 }

trunk/tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -1080 +1080 @@
                 // Raw values.
                 array(
-                    'title'       => '<a href="#" target="_blank" data-unfiltered=true>link</a>',
-                    'description' => '<a href="#" target="_blank" data-unfiltered=true>link</a>',
-                    'caption'     => '<a href="#" target="_blank" data-unfiltered=true>link</a>',
+                    'title'       => '<a href="#" target="_blank" unfiltered=true>link</a>',
+                    'description' => '<a href="#" target="_blank" unfiltered=true>link</a>',
+                    'caption'     => '<a href="#" target="_blank" unfiltered=true>link</a>',
                 ),
                 // Expected returned values.

trunk/tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -3284 +3284 @@
                 // Raw values.
                 array(
-                    'title'   => '<a href="#" target="_blank" data-unfiltered=true>link</a>',
-                    'content' => '<a href="#" target="_blank" data-unfiltered=true>link</a>',
-                    'excerpt' => '<a href="#" target="_blank" data-unfiltered=true>link</a>',
+                    'title'   => '<a href="#" target="_blank" unfiltered=true>link</a>',
+                    'content' => '<a href="#" target="_blank" unfiltered=true>link</a>',
+                    'excerpt' => '<a href="#" target="_blank" unfiltered=true>link</a>',
                 ),
                 // Expected returned values.