Changeset 51963 for trunk/src/wp-includes/kses.php

Timestamp:

11/01/2021 02:12:09 AM (3 years ago)

Author:

pento

Message:

KSES: Add options for restricting tags based upon their attributes.

This change adds two now attribute-related config options to KSES:

• An array of allowed values can be defined for attributes. If the attribute value doesn't fall into the list, the attribute will be removed from the tag.
• Attributes can be marked as required. If a required attribute is not present, KSES will remove all attributes from the tag. As KSES doesn't match opening and closing tags, it's not possible to safely remove the tag itself, the safest fallback is to strip all attributes from the tag, instead.

Included with this change is an implementation of these options, allowing the <object> tag to be stored in posts, but only when it has a type attribute set to application/pdf.

Props pento, swissspidy, peterwilsoncc, dd32, jorbin.
Fixes #54261.

File:

• trunk/src/wp-includes/kses.php (modified) (3 diffs)

trunk/src/wp-includes/kses.php

@@ -271 +271 @@
             'lang'     => true,
             'xml:lang' => true,
+        ),
+        'object'     => array(
+            'data' => true,
+            'type' => array(
+                'required' => true,
+                'values'   => array( 'application/pdf' ),
+            ),
         ),
         'p'          => array(
@@ -1166 +1173 @@
     $attrarr = wp_kses_hair( $attr, $allowed_protocols );
 
+    // Check if there are attributes that are required.
+    $required_attrs = array_filter(
+        $allowed_html[ $element_low ],
+        function( $required_attr_limits ) {
+            return isset( $required_attr_limits['required'] ) && true === $required_attr_limits['required'];
+        }
+    );
+
+    // If a required attribute check fails, we can return nothing for a self-closing tag,
+    // but for a non-self-closing tag the best option is to return the element with attributes,
+    // as KSES doesn't handle matching the relevant closing tag.
+    $stripped_tag = '';
+    if ( empty( $xhtml_slash ) ) {
+        $stripped_tag = "<$element>";
+    }
+
     // Go through $attrarr, and save the allowed attributes for this element
     // in $attr2.
     $attr2 = '';
     foreach ( $attrarr as $arreach ) {
+        // Check if this attribute is required.
+        $required = isset( $required_attrs[ strtolower( $arreach['name'] ) ] );
+
         if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) {
             $attr2 .= ' ' . $arreach['whole'];
+
+            // If this was a required attribute, we can mark it as found.
+            if ( $required ) {
+                unset( $required_attrs[ strtolower( $arreach['name'] ) ] );
+            }
+        } elseif ( $required ) {
+            // This attribute was required, but didn't pass the check. The entire tag is not allowed.
+            return $stripped_tag;
         }
+    }
+
+    // If some required attributes weren't set, the entire tag is not allowed.
+    if ( ! empty( $required_attrs ) ) {
+        return $stripped_tag;
     }
 
@@ -1601 +1640 @@
             }
             break;
+
+        case 'values':
+            /*
+             * The values check is used when you want to make sure that the attribute
+             * has one of the given values.
+             */
+
+            if ( false === array_search( strtolower( $value ), $checkvalue, true ) ) {
+                $ok = false;
+            }
+            break;
     } // End switch.