Make WordPress Core


Ignore:
Timestamp:
12/02/2021 12:54:03 AM (2 months ago)
Author:
peterwilsoncc
Message:

KSES: Allow attributes to be restricted via callbacks.

Add callback validation to HTML tag attributes for increased flexibility over an array of values only.

In object tags, validate the data attribute via a callback to ensure it is a PDF and matches the type attribute. This prevents mime type mismatches in browsers.

Follow up to [51963].

Props Pento, dd32, swissspidy, xknown, peterwilsoncc.
Fixes #54261.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/tests/phpunit/tests/kses.php

    r52229 r52304  
    15181518        return array(
    15191519            'valid value for type'                    => array(
    1520                 '<object type="application/pdf" data="https://wordpress.org/foo.pdf" />',
    1521                 '<object type="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1520                '<object type="application/pdf" data="https://example.org/foo.pdf" />',
     1521                '<object type="application/pdf" data="https://example.org/foo.pdf" />',
    15221522            ),
    15231523            'invalid value for type'                  => array(
    1524                 '<object type="application/exe" data="https://wordpress.org/foo.exe" />',
     1524                '<object type="application/exe" data="https://example.org/foo.exe" />',
    15251525                '',
    15261526            ),
    15271527            'multiple type attributes, last invalid'  => array(
    1528                 '<object type="application/pdf" type="application/exe" data="https://wordpress.org/foo.pdf" />',
    1529                 '<object type="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1528                '<object type="application/pdf" type="application/exe" data="https://example.org/foo.pdf" />',
     1529                '<object type="application/pdf" data="https://example.org/foo.pdf" />',
    15301530            ),
    15311531            'multiple type attributes, first uppercase, last invalid' => array(
    1532                 '<object TYPE="application/pdf" type="application/exe" data="https://wordpress.org/foo.pdf" />',
    1533                 '<object TYPE="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1532                '<object TYPE="application/pdf" type="application/exe" data="https://example.org/foo.pdf" />',
     1533                '<object TYPE="application/pdf" data="https://example.org/foo.pdf" />',
    15341534            ),
    15351535            'multiple type attributes, last upper case and invalid' => array(
    1536                 '<object type="application/pdf" TYPE="application/exe" data="https://wordpress.org/foo.pdf" />',
    1537                 '<object type="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1536                '<object type="application/pdf" TYPE="application/exe" data="https://example.org/foo.pdf" />',
     1537                '<object type="application/pdf" data="https://example.org/foo.pdf" />',
    15381538            ),
    15391539            'multiple type attributes, first invalid' => array(
    1540                 '<object type="application/exe" type="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1540                '<object type="application/exe" type="application/pdf" data="https://example.org/foo.pdf" />',
    15411541                '',
    15421542            ),
    15431543            'multiple type attributes, first upper case and invalid' => array(
    1544                 '<object TYPE="application/exe" type="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1544                '<object TYPE="application/exe" type="application/pdf" data="https://example.org/foo.pdf" />',
    15451545                '',
    15461546            ),
    15471547            'multiple type attributes, first invalid, last uppercase' => array(
    1548                 '<object type="application/exe" TYPE="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1548                '<object type="application/exe" TYPE="application/pdf" data="https://example.org/foo.pdf" />',
    15491549                '',
    15501550            ),
    15511551            'multiple object tags, last invalid'      => array(
    1552                 '<object type="application/pdf" data="https://wordpress.org/foo.pdf" /><object type="application/exe" data="https://wordpress.org/foo.exe" />',
    1553                 '<object type="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1552                '<object type="application/pdf" data="https://example.org/foo.pdf" /><object type="application/exe" data="https://example.org/foo.exe" />',
     1553                '<object type="application/pdf" data="https://example.org/foo.pdf" />',
    15541554            ),
    15551555            'multiple object tags, first invalid'     => array(
    1556                 '<object type="application/exe" data="https://wordpress.org/foo.exe" /><object type="application/pdf" data="https://wordpress.org/foo.pdf" />',
    1557                 '<object type="application/pdf" data="https://wordpress.org/foo.pdf" />',
     1556                '<object type="application/exe" data="https://example.org/foo.exe" /><object type="application/pdf" data="https://example.org/foo.pdf" />',
     1557                '<object type="application/pdf" data="https://example.org/foo.pdf" />',
    15581558            ),
    15591559            'type attribute with partially incorrect value' => array(
    1560                 '<object type="application/pdfa" data="https://wordpress.org/foo.pdf" />',
     1560                '<object type="application/pdfa" data="https://example.org/foo.pdf" />',
    15611561                '',
    15621562            ),
    15631563            'type attribute with empty value'         => array(
    1564                 '<object type="" data="https://wordpress.org/foo.pdf" />',
     1564                '<object type="" data="https://example.org/foo.pdf" />',
    15651565                '',
    15661566            ),
    15671567            'type attribute with no value'            => array(
    1568                 '<object type data="https://wordpress.org/foo.pdf" />',
     1568                '<object type data="https://example.org/foo.pdf" />',
    15691569                '',
    15701570            ),
    15711571            'no type attribute'                       => array(
    1572                 '<object data="https://wordpress.org/foo.pdf" />',
     1572                '<object data="https://example.org/foo.pdf" />',
     1573                '',
     1574            ),
     1575            'different protocol in url'               => array(
     1576                '<object type="application/pdf" data="http://example.org/foo.pdf" />',
     1577                '<object type="application/pdf" data="http://example.org/foo.pdf" />',
     1578            ),
     1579            'query string on url'                     => array(
     1580                '<object type="application/pdf" data="https://example.org/foo.pdf?lol=.pdf" />',
     1581                '',
     1582            ),
     1583            'fragment on url'                         => array(
     1584                '<object type="application/pdf" data="https://example.org/foo.pdf#lol.pdf" />',
     1585                '',
     1586            ),
     1587            'wrong extension'                         => array(
     1588                '<object type="application/pdf" data="https://example.org/foo.php" />',
     1589                '',
     1590            ),
     1591            'protocol relative url'                   => array(
     1592                '<object type="application/pdf" data="//example.org/foo.pdf" />',
     1593                '',
     1594            ),
     1595            'relative url'                            => array(
     1596                '<object type="application/pdf" data="/cat/foo.pdf" />',
    15731597                '',
    15741598            ),
Note: See TracChangeset for help on using the changeset viewer.