Changeset 62530

Timestamp:

06/19/2026 06:41:13 AM (8 weeks ago)

Author:

wildworks

Message:

KSES: Allow SVG presentation attributes in safe_style_css.

Add SVG presentation attributes to the list of CSS properties allowed by safecss_filter_attr(), so inline SVG markup can be styled via the style attribute.

This ports Gutenberg PR #79172 to Core.

Props afercia, westonruter, wildworks.
Fixes #65457.

Location:

trunk

Files:

• src/wp-includes/kses.php (modified) (2 diffs)
• tests/phpunit/tests/kses.php (modified) (2 diffs)

trunk/src/wp-includes/kses.php

@@ -2580 +2580 @@
          *
          * @since 2.8.1
+         * @since 7.1.0 Added support for SVG presentation attributes.
          *
          * @param string[] $attr Array of allowed CSS attributes.
@@ -2738 +2739 @@
                         'container-type',
 
+                        'fill',
+                        'fill-opacity',
+                        'fill-rule',
+
+                        'stroke',
+                        'stroke-dasharray',
+                        'stroke-dashoffset',
+                        'stroke-linecap',
+                        'stroke-linejoin',
+                        'stroke-miterlimit',
+                        'stroke-opacity',
+                        'stroke-width',
+
+                        'color-interpolation',
+                        'color-interpolation-filters',
+                        'paint-order',
+                        'stop-color',
+                        'stop-opacity',
+                        'flood-color',
+                        'flood-opacity',
+                        'lighting-color',
+
+                        'marker',
+                        'marker-end',
+                        'marker-mid',
+                        'marker-start',
+
+                        'clip-path',
+                        'clip-rule',
+                        'mask',
+                        'mask-type',
+
+                        'cx',
+                        'cy',
+                        'r',
+                        'rx',
+                        'ry',
+                        'x',
+                        'y',
+                        'd',
+
+                        'alignment-baseline',
+                        'baseline-shift',
+                        'dominant-baseline',
+                        'glyph-orientation-horizontal',
+                        'glyph-orientation-vertical',
+                        'text-anchor',
+                        'unicode-bidi',
+                        'word-spacing',
+
+                        'font-size-adjust',
+                        'font-stretch',
+
+                        'color-rendering',
+                        'image-rendering',
+                        'shape-rendering',
+                        'text-rendering',
+                        'vector-effect',
+
+                        'transform',
+                        'transform-origin',
+
+                        'pointer-events',
+                        'visibility',
+
                         // Custom CSS properties.
                         '--*',

trunk/tests/phpunit/tests/kses.php

@@ -1001 +1001 @@
          * @ticket 60132
          * @ticket 64414
+         * @ticket 65457
          *
          * @dataProvider data_safecss_filter_attr
@@ -1473 +1474 @@
                                 'css'      => 'display: grid',
                                 'expected' => 'display: grid',
+                        ),
+                        // SVG presentation attributes introduced in 7.1.0.
+                        array(
+                                'css'      => 'fill: none',
+                                'expected' => 'fill: none',
+                        ),
+                        array(
+                                'css'      => 'fill-rule: evenodd',
+                                'expected' => 'fill-rule: evenodd',
+                        ),
+                        array(
+                                'css'      => 'stroke: red',
+                                'expected' => 'stroke: red',
+                        ),
+                        array(
+                                'css'      => 'stroke-width: 2',
+                                'expected' => 'stroke-width: 2',
+                        ),
+                        array(
+                                'css'      => 'stroke-linecap: round',
+                                'expected' => 'stroke-linecap: round',
+                        ),
+                        array(
+                                'css'      => 'paint-order: stroke',
+                                'expected' => 'paint-order: stroke',
+                        ),
+                        array(
+                                'css'      => 'vector-effect: non-scaling-stroke',
+                                'expected' => 'vector-effect: non-scaling-stroke',
+                        ),
+                        array(
+                                'css'      => 'clip-rule: evenodd',
+                                'expected' => 'clip-rule: evenodd',
+                        ),
+                        array(
+                                'css'      => 'text-anchor: middle',
+                                'expected' => 'text-anchor: middle',
                         ),
                 );