Changeset 55345 for trunk/src/wp-includes/class-wp-theme-json.php

Timestamp:

02/15/2023 03:55:12 AM (3 years ago)

Author:

peterwilsoncc

Message:

Editor: Prevent KSES stripping global layout style properties.

Layout style properties are stored using indirect values, rather than direct CSS properties.

Allow users without the unfiltered_html capability to modify global styles using the indirect block spacing properties contentSize, wideSize, and blockGap, using a mapping of the eventual CSS property to the indirect property stored in theme.json. The mapped CSS property is then used for CSS validation.

Props andrewserong, costdev, hellofromtonya, mamaduka, mmtr86.
Fixes #57321.

File:

• trunk/src/wp-includes/class-wp-theme-json.php (modified) (4 diffs)

trunk/src/wp-includes/class-wp-theme-json.php

@@ -264 +264 @@
 
     /**
+     * Indirect metadata for style properties that are not directly output.
+     *
+     * Each element maps from a CSS property name to an array of
+     * paths to the value in theme.json & block attributes.
+     *
+     * Indirect properties are not output directly by `compute_style_properties`,
+     * but are used elsewhere in the processing of global styles. The indirect
+     * property is used to validate whether or not a style value is allowed.
+     *
+     * @since 6.1.2
+     * @var array
+     */
+    const INDIRECT_PROPERTIES_METADATA = array(
+        'gap'        => array(
+            array( 'spacing', 'blockGap' ),
+        ),
+        'column-gap' => array(
+            array( 'spacing', 'blockGap', 'left' ),
+        ),
+        'row-gap'    => array(
+            array( 'spacing', 'blockGap', 'top' ),
+        ),
+        'max-width'  => array(
+            array( 'layout', 'contentSize' ),
+            array( 'layout', 'wideSize' ),
+        ),
+    );
+
+    /**
      * Protected style properties.
      *
@@ -2950 +2979 @@
             }
         }
+
+        // Ensure indirect properties not included in any `PRESETS_METADATA` value are allowed.
+        static::remove_indirect_properties( $input, $output );
+
         return $output;
     }
@@ -2978 +3011 @@
             }
         }
+
+        // Ensure indirect properties not handled by `compute_style_properties` are allowed.
+        static::remove_indirect_properties( $input, $output );
+
         return $output;
     }
@@ -2994 +3031 @@
         $filtered          = esc_html( safecss_filter_attr( $style_to_validate ) );
         return ! empty( trim( $filtered ) );
+    }
+
+    /**
+     * Removes indirect properties from the given input node and
+     * sets in the given output node.
+     *
+     * @since 6.1.2
+     *
+     * @param array $input  Node to process.
+     * @param array $output The processed node. Passed by reference.
+     */
+    private static function remove_indirect_properties( $input, &$output ) {
+        foreach ( static::INDIRECT_PROPERTIES_METADATA as $property => $paths ) {
+            foreach ( $paths as $path ) {
+                $value = _wp_array_get( $input, $path );
+                if (
+                    is_string( $value ) &&
+                    static::is_safe_css_declaration( $property, $value )
+                ) {
+                    _wp_array_set( $output, $path, $value );
+                }
+            }
+        }
     }