Changeset 54100 for trunk/src/wp-includes/kses.php

Timestamp:

09/08/2022 01:24:10 PM (4 years ago)

Author:

SergeyBiryukov

Message:

KSES: Allow min(), max(), minmax(), and clamp() values to be used in inline CSS.

Additionally, this commit updates safecss_filter_attr() to add support for nested var() functions, so that a fallback value can be another CSS variable.

Follow-up to [50923].

Props johnregan3, noisysocks, cbravobernal, uxl, isabel_brison, andrewserong, ramonopoly, joyously, bernhard-reiter, peterwilsoncc.
Fixes #55966.

File:

• trunk/src/wp-includes/kses.php (modified) (2 diffs)

trunk/src/wp-includes/kses.php

@@ -2229 +2229 @@
  * @since 5.7.1 Added support for `object-position`.
  * @since 5.8.0 Added support for `calc()` and `var()` values.
+ * @since 6.1.0 Added support for `min()`, `max()`, `minmax()`, `clamp()`,
+ *              and nested `var()` values.
  *
  * @param string $css        A string of CSS rules.
@@ -2468 +2470 @@
 
                 if ( $found ) {
-                        // Allow CSS calc().
-                        $css_test_string = preg_replace( '/calc\(((?:\([^()]*\)?|[^()])*)\)/', '', $css_test_string );
-                        // Allow CSS var().
-                        $css_test_string = preg_replace( '/\(?var\(--[a-zA-Z0-9_-]*\)/', '', $css_test_string );
-
-                        // Check for any CSS containing \ ( & } = or comments,
-                        // except for url(), calc(), or var() usage checked above.
+                        /*
+                         * Allow CSS functions like var(), calc(), etc. by removing them from the test string.
+                         * Nested functions and parentheses are also removed, so long as the parentheses are balanced.
+                         */
+                        $css_test_string = preg_replace(
+                                '/\b(?:var|calc|min|max|minmax|clamp)(\((?:[^()]|(?1))*\))/',
+                                '',
+                                $css_test_string
+                        );
+
+                        /*
+                         * Disallow CSS containing \ ( & } = or comments, except for within url(), var(), calc(), etc.
+                         * which were removed from the test string above.
+                         */
                         $allow_css = ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string );