WordPress.org

Make WordPress Core

Opened 8 months ago

Closed 2 weeks ago

Last modified 2 weeks ago

#48608 closed defect (bug) (duplicate)

SVG tags with numbers in attributes filtered out by KSES despite being allowed

Reported by: johnpgreen Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Formatting Keywords:
Focuses: Cc:

Description

I have been able to successfully extend $allowedposttags using the wp_kses_allowed_html filter to allow a limited set of SVG tags but have encountered issues when attempting to use the <linearGradient> SVG element. This element is unique among the elements I have added in that it has attributes - specifically x1, x2, y1, and y2 - that contain numbers.

I believe I have narrowed down the culprit to the wp_kses_hair function, specifically that case 0 seems to only allow alpha characters.

Change History (6)

#1 @SergeyBiryukov
8 months ago

  • Component changed from General to Formatting

#2 @johnpgreen
6 months ago

FYI - this issue also effects the <line> SVG element.

#4 @rilwis
3 months ago

I confirm this issue. The linearGradient tag is helpful to use gradient in SVG and is used quite often.

#5 @whyisjake
2 weeks ago

  • Milestone Awaiting Review deleted
  • Resolution set to duplicate
  • Status changed from new to closed

Duplicate of #49464.

#6 @whyisjake
2 weeks ago

In 48132:

Formatting: Extend wp_kses_hair and wp_kses_hair_parse to allow digits and underscores.

Fixes a lot of issues around parsing XML/HTML attributes.

Fixes #49464.

See #34406, #48608.

Props codeforest, zodiac1978, johnpgreen, dlh, ayeshrajans, johnpgreen, rilwis, travisnorthcutt, miqrogroove, chriscct7, whyisjake.

Note: See TracTickets for help on using tickets.