Make WordPress Core

Opened 10 years ago

Closed 10 years ago

#34105 closed defect (bug) (fixed)

kses strips tags with hyphens in the name

Reported by: batmoo's profile batmoo Owned by: jorbin's profile jorbin
Milestone: 4.7 Priority: normal
Severity: normal Version:
Component: Formatting Keywords: has-patch
Focuses: Cc:

Description

The W3C Custom Elements spec (http://www.w3.org/TR/custom-elements/#concepts) allows you to use your own custom DOM elements/tags. One of the main requirements is that the tag name "must contain a U+002D HYPHEN-MINUS character".

However, kses does not currently factor in the hyphen and strips out tags, even if they're set to be explicitly allowed:

$string = '<hyphenated-tag>Hello</hyphenated-tag>';
wp_kses( $string, array( 'hyphenated-tag' => array() ) );

// returns 'Hello' but should be '<hyphenated-tag>Hello</hyphenated-tag>'

This is because the regex for parsing the element name within kses only allow alphanumerics. It would be nice if this was loosened to allow hyphens in the tag name.

Attachments (2)

34105.diff (448 bytes) - added by batmoo 10 years ago.
34105-tests.diff (888 bytes) - added by batmoo 10 years ago.

Download all attachments as: .zip

Change History (7)

@batmoo
10 years ago

@batmoo
10 years ago

#1 @batmoo
10 years ago

  • Keywords has-patch added

Attached patches attempt a quick pass at this and include basic tests.

#2 @obenland
10 years ago

  • Version trunk deleted

#3 @johnregan3
10 years ago

Polite bump for this one, as escaping AMP HTML tags often requires allowing hyphens, as in, <amp-ad></amp-ad>.
https://ampbyexample.com/components/amp-ad/

#4 @SergeyBiryukov
10 years ago

  • Milestone changed from Awaiting Review to 4.7

#5 @jorbin
10 years ago

  • Owner set to jorbin
  • Resolution set to fixed
  • Status changed from new to closed

In 38511:

Formatting: Allow KSES custom elements with hyphens

The W3C Custom Elements spec (http://www.w3.org/TR/custom-elements/#concepts) allows you to use your own custom DOM elements/tags. One of the main requirements is that the tag name "must contain a U+002D HYPHEN-MINUS character". This adjusts KSES to allow it.

Fixes #34105.
Props batmoo.

Note: See TracTickets for help on using tickets.