Changeset 44207

Timestamp:

12/15/2018 01:07:06 AM (5 years ago)

Author:

iandunn

Message:

KSES: Make the URI attributes DRY.

This commit introduces the wp_kses_uri_attributes function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

Merges [44014] and [44017] to trunk.

Location:

trunk

Files:

• . (modified) (1 prop)
• src/wp-includes/kses.php (modified) (3 diffs)

trunk/src/wp-includes/kses.php

@@ -760 +760 @@
  */
 function wp_kses_one_attr( $string, $element ) {
-    $uris              = array( 'xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action' );
+    $uris              = wp_kses_uri_attributes();
     $allowed_html      = wp_kses_allowed_html( 'post' );
     $allowed_protocols = wp_allowed_protocols();
@@ -934 +934 @@
     $pass_allowed_protocols = $allowed_protocols;
     return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $string );
+}
+
+/**
+ * Helper function listing HTML attributes containing a URL.
+ *
+ * This function returns a list of all HTML attributes that must contain
+ * a URL according to the HTML specification.
+ *
+ * This list includes URI attributes both allowed and disallowed by KSES.
+ *
+ * @link https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes
+ *
+ * @since 5.0.1
+ *
+ * @return array HTML attributes that must include a URL.
+ */
+function wp_kses_uri_attributes() {
+    $uri_attributes = array(
+        'action',
+        'archive',
+        'background',
+        'cite',
+        'classid',
+        'codebase',
+        'data',
+        'formaction',
+        'href',
+        'icon',
+        'longdesc',
+        'manifest',
+        'poster',
+        'profile',
+        'src',
+        'usemap',
+        'xmlns',
+    );
+
+    /**
+     * Filters the list of attributes that are required to contain a URL.
+     *
+     * Use this filter to add any `data-` attributes that are required to be
+     * validated as a URL.
+     *
+     * @since 5.0.1
+     *
+     * @param array $uri_attributes HTML attributes requiring validation as a URL.
+     */
+    $uri_attributes = apply_filters( 'wp_kses_uri_attributes', $uri_attributes );
+
+    return $uri_attributes;
 }
 
@@ -1163 +1213 @@
     $mode     = 0;
     $attrname = '';
-    $uris     = array( 'xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action' );
+    $uris     = wp_kses_uri_attributes();
 
     // Loop through the whole attribute list