safecss_filter_attr remove styles with calc()

[displaynone]

I have a shortcode inside a tag attribute:

<a style="color:#d0c900; width: calc([myshortcode]% *10*1 );">

Executing do_shortcode returns:

<a style="color:#d0c900;">

Debuging safecss_filter_attr I found that if the attribute contains a parentheses, the method ignores it. So using: calc( 100% - 20px ) is not allowed

[joyously]

There are quite a few valid things that would get removed. Gradients and filters and var can also have parentheses, not to mention data URIs or content values.

But what is odd is that the $allowed_attr is filtered, and if empty, no other change is made to the $css. Only if it has something is the $css further manipulated. This seems backward.

This patch allows using ( in CSS sanitized using the safecss_filter_attr function.
The original regex was created more than a decade ago, and back then we didn't have things like calc(), var() etc - so disallowing ( made sense. This is no longer the case.

Trac ticket: https://core.trac.wordpress.org/ticket/46197

This also fixes ​https://github.com/WordPress/gutenberg/pull/31740 in Gutenberg, as well as https://core.trac.wordpress.org/ticket/46498

[SergeyBiryukov]

In 50923:

KSES: Allow calc() and var() values to be used in inline CSS.

Props aristath, displaynone, joyously, olafklejnstrupjensen, sabernhardt, jamesbonham, poena.
Fixes #46197, #46498.

https://core.trac.wordpress.org/ticket/46197 is now patched

Trac ticket: https://core.trac.wordpress.org/ticket/55356

Thanks for the PR! This was merged into Core in https://core.trac.wordpress.org/changeset/52924.