WordPress.org

Make WordPress Core

Opened 4 years ago

Closed 3 years ago

#34105 closed defect (bug) (fixed)

kses strips tags with hyphens in the name

Reported by: batmoo Owned by: jorbin
Milestone: 4.7 Priority: normal
Severity: normal Version:
Component: Formatting Keywords: has-patch
Focuses: Cc:
PR Number:

Description

The W3C Custom Elements spec (http://www.w3.org/TR/custom-elements/#concepts) allows you to use your own custom DOM elements/tags. One of the main requirements is that the tag name "must contain a U+002D HYPHEN-MINUS character".

However, kses does not currently factor in the hyphen and strips out tags, even if they're set to be explicitly allowed:

$string = '<hyphenated-tag>Hello</hyphenated-tag>';
wp_kses( $string, array( 'hyphenated-tag' => array() ) );

// returns 'Hello' but should be '<hyphenated-tag>Hello</hyphenated-tag>'

This is because the regex for parsing the element name within kses only allow alphanumerics. It would be nice if this was loosened to allow hyphens in the tag name.

Attachments (2)

34105.diff (448 bytes) - added by batmoo 4 years ago.
34105-tests.diff (888 bytes) - added by batmoo 4 years ago.

Download all attachments as: .zip

Change History (7)

@batmoo
4 years ago

@batmoo
4 years ago

#1 @batmoo
4 years ago

  • Keywords has-patch added

Attached patches attempt a quick pass at this and include basic tests.

#2 @obenland
4 years ago

  • Version trunk deleted

#3 @johnregan3
3 years ago

Polite bump for this one, as escaping AMP HTML tags often requires allowing hyphens, as in, <amp-ad></amp-ad>.
https://ampbyexample.com/components/amp-ad/

#4 @SergeyBiryukov
3 years ago

  • Milestone changed from Awaiting Review to 4.7

#5 @jorbin
3 years ago

  • Owner set to jorbin
  • Resolution set to fixed
  • Status changed from new to closed

In 38511:

Formatting: Allow KSES custom elements with hyphens

The W3C Custom Elements spec (http://www.w3.org/TR/custom-elements/#concepts) allows you to use your own custom DOM elements/tags. One of the main requirements is that the tag name "must contain a U+002D HYPHEN-MINUS character". This adjusts KSES to allow it.

Fixes #34105.
Props batmoo.

Note: See TracTickets for help on using tickets.