Changeset 62433 for trunk/src/wp-includes/kses.php

Timestamp:

05/31/2026 07:30:28 AM (39 hours ago)

Author:

dmsnell

Message:

KSES: Decode style attribute before sending to safecss_filter_attr().

safecss_filter_attr() assumes that it receives already-unescaped HTML
attribute values. For example, consider the raw HTML string:

style="background:url("bg.png")"

This should be decoded and passed into safecss_filter_attr() as:

background:url("bg.png")

Unfortuantely this hasn’t been done in wp_kses_attr_check(), which
takes the output from wp_kses_hair() and sends it directly to the
filtering function.

In this patch, wp_kses_attr_check() unescapes the style attribute,
filters it, and then re-escapes it when updating the style value.

Tests added by Codex

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11868
Discussed in: https://core.trac.wordpress.org/ticket/65270

Props dmsnell, westonruter.
Fixes #65270.

File:

• trunk/src/wp-includes/kses.php (modified) (4 diffs)

trunk/src/wp-includes/kses.php

@@ -1557 +1557 @@
 
     if ( 'style' === $name_low ) {
-        $new_value = safecss_filter_attr( $value );
+        $decoded_value = WP_HTML_Decoder::decode_attribute( $value );
+        $new_value     = safecss_filter_attr( $decoded_value );
 
         if ( empty( $new_value ) ) {
@@ -1566 +1567 @@
         }
 
-        $whole = str_replace( $value, $new_value, $whole );
-        $value = $new_value;
+        if ( $new_value !== $decoded_value ) {
+            $encoded_value = esc_attr( $new_value );
+            $whole         = str_replace( $value, $encoded_value, $whole );
+            $value         = $encoded_value;
+        }
     }
 
@@ -2555 +2559 @@
  * @since 6.9.0 Added support for `white-space`.
  *
- * @param string $css        A string of CSS rules.
+ * @param string $css        A string of CSS rules, decoded from an HTML `style` attribute.
  * @param string $deprecated Not used.
- * @return string Filtered string of CSS rules.
+ * @return string Filtered string of CSS rules, needing HTML escaping before sending back to a `style` attribute.
  */
 function safecss_filter_attr( $css, $deprecated = '' ) {
@@ -2569 +2573 @@
     $allowed_protocols = wp_allowed_protocols();
 
+    /** @todo Parse enough CSS to split rules without breaking on things like quoted strings. */
     $css_array = explode( ';', trim( $css ) );