Changeset 44020 for branches/4.9

Timestamp:

12/13/2018 12:13:03 AM (4 years ago)

Author:

iandunn

Message:

KSES: Make the URI attributes DRY.

This commit introduces the wp_kses_uri_attributes function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

Merges [44014] and [44017] to the 4.9 branch.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-includes/kses.php (modified) (3 diffs)

branches/4.9/src/wp-includes/kses.php

@@ -537 +537 @@
  */
 function wp_kses_one_attr( $string, $element ) {
-    $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
+    $uris = wp_kses_uri_attributes();
     $allowed_html = wp_kses_allowed_html( 'post' );
     $allowed_protocols = wp_allowed_protocols();
@@ -735 +735 @@
 
 /**
+ * Helper function listing HTML attributes containing a URL.
+ *
+ * This function returns a list of all HTML attributes that must contain
+ * a URL according to the HTML specification.
+ *
+ * This list includes URI attributes both allowed and disallowed by KSES.
+ *
+ * @link https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes
+ *
+ * @since 5.0.1
+ *
+ * @return array HTML attributes that must include a URL.
+ */
+function wp_kses_uri_attributes() {
+    $uri_attributes = array(
+        'action',
+        'archive',
+        'background',
+        'cite',
+        'classid',
+        'codebase',
+        'data',
+        'formaction',
+        'href',
+        'icon',
+        'longdesc',
+        'manifest',
+        'poster',
+        'profile',
+        'src',
+        'usemap',
+        'xmlns',
+    );
+
+    /**
+     * Filters the list of attributes that are required to contain a URL.
+     *
+     * Use this filter to add any `data-` attributes that are required to be
+     * validated as a URL.
+     *
+     * @since 5.0.1
+     *
+     * @param array $uri_attributes HTML attributes requiring validation as a URL.
+     */
+    $uri_attributes = apply_filters( 'wp_kses_uri_attributes', $uri_attributes );
+
+    return $uri_attributes;
+}
+
+/**
  * Callback for wp_kses_split.
  *
@@ -931 +981 @@
     $mode = 0;
     $attrname = '';
-    $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
+    $uris = wp_kses_uri_attributes();
 
     // Loop through the whole attribute list