Changeset 44014

Timestamp:

12/12/2018 11:52:05 PM (6 years ago)

Author:

iandunn

Message:

KSES: Make the URI attributes DRY.

This commit introduces the wp_kses_uri_attributes function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

File:

• branches/5.0/src/wp-includes/kses.php (modified) (3 diffs)

branches/5.0/src/wp-includes/kses.php

@@ -540 +540 @@
  */
 function wp_kses_one_attr( $string, $element ) {
-    $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
+    $uris = wp_kses_uri_attributes();
     $allowed_html = wp_kses_allowed_html( 'post' );
     $allowed_protocols = wp_allowed_protocols();
@@ -735 +735 @@
     $pass_allowed_protocols = $allowed_protocols;
     return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $string );
+}
+
+/**
+ * Helper function listing HTML attributes containing a URL.
+ *
+ * This function returns a list of all HTML attributes that must contain
+ * a URL according to the HTML specification.
+ *
+ * This list includes URI attributes both allowed and disallowed by KSES.
+ *
+ * @link https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes
+ *
+ * @since 4.9.9
+ *
+ * @return array HTML attributes that must include a URL.
+ */
+function wp_kses_uri_attributes() {
+    $uri_attributes = array(
+        'action',
+        'archive',
+        'background',
+        'cite',
+        'classid',
+        'codebase',
+        'data',
+        'formaction',
+        'href',
+        'icon',
+        'longdesc',
+        'manifest',
+        'poster',
+        'profile',
+        'src',
+        'usemap',
+        'xmlns',
+    );
+
+    /**
+     * Filters the list of attributes that are required to contain a URL.
+     *
+     * Use this filter to add any `data-` attributes that are required to be
+     * validated as a URL.
+     *
+     * @since 4.9.9
+     *
+     * @param array $uri_attributes HTML attributes requiring validation as a URL.
+     */
+    $uri_attributes = apply_filters( 'wp_kses_uri_attributes', $uri_attributes );
+
+    return $uri_attributes;
 }
 
@@ -954 +1004 @@
     $mode = 0;
     $attrname = '';
-    $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
+    $uris = wp_kses_uri_attributes();
 
     // Loop through the whole attribute list