Add all HTML spec attributes to wp kses

[malthert]

Currently wp kses is missing loads of HTML5 attributes, e.g. input with minlength, maxlength, min, max, step,...

These should be added.

[audrasjb]

Hello,

Currently, the list of allowed tags and attributes is an allowlist, not a blocklist. Therefore, we need to add the HTML elements and attributes in the allowlist one by one.

This is handled in the $allowedposttags global, defined in the wp-includes/kses.php file: https://core.trac.wordpress.org/browser/tags/5.7.1/src/wp-includes/kses.php#L50

So. In order to help this ticket to move forward, we need a proposal concerning the tags and attributes you want to add to the allowlist. Please feel free to make a proposal. I think it would be great to add some explanation on why each tag or attribute should be allowlisted :)

[malthert]

I would like to add all specified in the HTML standard.
Specifically the ones listed here: ​https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes (shows attribute + the element they may be used in)

[audrasjb]

To clarify my first comment, there is no plan to add all the existing tags and attributes in the allowlist.

If there is a need concerning some specific tags/attributes, please provide full context on why they should be allowed. If you need to allow all the tags in the HTML5 specification for your projects, please use the provided hooks to allow them, like wp_kses_allowed_html (​https://developer.wordpress.org/reference/functions/wp_kses_allowed_html/)
:)

[malthert]

Why would we not add all allowed HTML attributes to this by default?
The current selection is completely arbitrary (e.g. the min/max/... for input, or even "id" attribute is not allowed for all HTML tags).

[malthert]

Duplicate of #55605.