CSS Selectors in style tags containing greater than signs are escaped

[bfintal]

If you have unfiltered html disallowed, and you have in your content a style tag with a > selector, the selector will be escaped into > preventing the CSS from working.

I've used the wp_kses_allowed_html filter to allow style tags in wp_kses.
I also have this defined to disallow unfiltered html:

define( 'DISALLOW_UNFILTERED_HTML', true );

Sample content:

<style>
body > header {
    background: red;
}
</style>

Saving this with unfiltered html disallowed would result in:

<style>
body &gt; header {
    background: red;
}
</style>

Since it's escaped, the CSS stops working.

I don't think there's a way to allow allow > signs in <style> tags.

[dmsnell]

I’m going to fold this into the work in #66208 by marking it as a duplicate, even though this issue is older. The linked ticket rewrites wp_kses() comprehensively and addresses this issue as a byproduct of replacing the HTML parsing code.

php -r 'require __DIR__ . "/src/wp-load.php"; $context = ["style"=>true]; $html = wp_slash( file_get_contents( "php://stdin" ) ); echo "\e[31mBEFORE\e[m\n\n\e[90m" . wp_kses( $html, $context ) . "\n\n\e[32mAFTER\e[m\n\n" . wp_sanitize_html_kses( $html, $context );' <(pbpaste | psub)
BEFORE

<style>
body &gt; header {
    background: red;
}
</style>

AFTER

<style>
body > header {
    background: red;
}
</style>⏎