Make WordPress Core

Opened 7 years ago

Last modified 8 months ago

#24157 new defect (bug)

safecss_filter_attr doesn't allow rgb() in inline styles

Reported by: joehoyle Owned by:
Milestone: Priority: normal
Severity: normal Version: 2.8.1
Component: Formatting Keywords: kses
Focuses: Cc:
PR Number:


I thought there should be a ticket somewhere, but I couldn't find it!

So, safecss_filter_attr (which is used in wp_kses etc, does not allow inline styles that include rgba() etc, like his:

<span style="background: rgb(0,0,0)"></span>

I am not sure if this is intended, though not sure why it would be, there is a comment in safecss_filter_attr

if ( preg_match( '%[\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments

Attachments (1)

kses.diff (1.3 KB) - added by joehoyle 7 years ago.
Unit tests for safecss_filter_attr

Download all attachments as: .zip

Change History (9)

#1 @ericlewis
7 years ago

Introduced in [11689], related: #10336

#2 @SergeyBiryukov
7 years ago

  • Version changed from 3.5.1 to 2.8.1

#3 @joehoyle
7 years ago

I wanted to open the discussion up to what css should be supported, and what is deemed insecure. AFAIK css expression as the main reason for this restriction, whereas there are a lot of CSS values that are currently not allowed due to the stripping of (, e.g. bg image urls, gradients, other css 3 "functions", rgb(a), hsla to name some.

I was going to write a patch to whitelist rgb for this ticket, however, if css expressions http://webfx.eae.net/dhtml/cssexpr/cssexpr.html are the only issue (which I believe are only available in <= IE7) then does it make more sense to blacklist "expression" rather than trying to write complex regex to whitelist the others?

7 years ago

Unit tests for safecss_filter_attr

#4 @nacin
6 years ago

  • Milestone changed from Awaiting Review to Future Release

It seems to me like safecss_filter_attr() is pretty ancient and probably due for an upgrade, but that it's possible that a proper upgrade to be safe yet expansive in features would require a huge and slow library. I'm curious myself.

Thanks for the unit tests. We may be able to work around rgb(a), at the very least.

The folks who work on WordPress.com probably have the most experience with safe CSS, given their feature set. Flagging westi et al.

#5 @postpostmodern
6 years ago

I recently had safecss_filter_attr() fail when trying to embed an html 'Large Button' from iTunes linkmaker, the issue was an inline media query containing curly brackets. Which, is probably not a good practice, but it seems like it should be able to pass nonetheless. For reference, the style generated from https://linkmaker.itunes.apple.com/us/ which fails is

style="display:inline-block;overflow:hidden;background:url(https://linkmaker.itunes.apple.com/htmlResources/assets/en_us//images/web/linkmaker/badge_itunes-lrg.png) no-repeat;width:110px;height:40px;@media only screen{background-image:url(https://linkmaker.itunes.apple.com/htmlResources/assets/en_us//images/web/linkmaker/badge_itunes-lrg.svg);}"

#6 @miqrogroove
5 years ago

  • Keywords kses added

#7 @bendog
5 years ago

Still an issue in 4.2.2

I'm trying to allow some advanced comment editing for a blog's members. Most works except rgb(a) colour overrides.

#8 @paulschreiber
4 years ago

See related #37134 (with proposed filter/patch).

Note: See TracTickets for help on using tickets.