Make WordPress Core

Opened 7 years ago

Closed 6 years ago

Last modified 6 years ago

#48608 closed defect (bug) (duplicate)

SVG tags with numbers in attributes filtered out by KSES despite being allowed

Reported by: johnpgreen Owned by:
Priority: normal Milestone:
Component: Formatting Version:
Severity: normal Keywords:
Cc: Focuses:

Description

I have been able to successfully extend $allowedposttags using the wp_kses_allowed_html filter to allow a limited set of SVG tags but have encountered issues when attempting to use the <linearGradient> SVG element. This element is unique among the elements I have added in that it has attributes - specifically x1, x2, y1, and y2 - that contain numbers.

I believe I have narrowed down the culprit to the wp_kses_hair function, specifically that case 0 seems to only allow alpha characters.

Change History (6)

#1 @SergeyBiryukov
7 years ago

  • Component General → Formatting

#2 @johnpgreen
7 years ago

FYI - this issue also effects the <line> SVG element.

#4 @rilwis
7 years ago

I confirm this issue. The linearGradient tag is helpful to use gradient in SVG and is used quite often.

#5 @whyisjake
6 years ago

  • Milestone Awaiting Review
  • Resolution → duplicate
  • Status new → closed

Duplicate of #49464.

#6 @whyisjake
6 years ago

In 48132:

Formatting: Extend wp_kses_hair and wp_kses_hair_parse to allow digits and underscores.

Fixes a lot of issues around parsing XML/HTML attributes.

Fixes #49464.

See #34406, #48608.

Props codeforest, zodiac1978, johnpgreen, dlh, ayeshrajans, johnpgreen, rilwis, travisnorthcutt, miqrogroove, chriscct7, whyisjake.

Note: See TracTickets for help on using tickets.