Make WordPress Core

Opened 2 years ago

Closed 8 weeks ago

Last modified 8 weeks ago

#56391 closed defect (bug) (duplicate)

safecss_filter_attr(): support rgba background-color

Reported by: wildworks's profile wildworks Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Security Keywords: has-patch has-unit-tests
Focuses: Cc:


This ticket allows rgba-valued background-color in safecss_filter_attr.

It was ( in Gutenberg that triggered this ticket.

In RichText, when an inline text color is specified, a transparent background color style (background-color:rgba(0, 0, 0, 0)) is generated at the same time.
This is to disable the browser's default style (yellow for Chrome), since highlighted text is wrapped with a mark tag.

However, this background color is sanitized by wp_kes_post, and the browser's default style is restored.

This ticket proposes to allow rgba values only for background-color.
Please check with the additions to the Unit Test to see what values are allowed.

Change History (10)

This ticket was mentioned in PR #3097 on WordPress/wordpress-develop by t-hamano.

2 years ago

  • Keywords has-unit-tests added

#2 @wildworks
2 years ago

I initially submitted a PR that attempted to resolve this problem only in the block where it was occurring.

However, it was considered that it would be better to support rgba in safecss_filter_attr, so I submitted a ticket.

t-hamano commented on PR #3097:

2 years ago

I have added support for RGB and allowed some properties, and updated regular expressions.
And I have tried to cover as many variations of the test as possible. Is this enough?

t-hamano commented on PR #3097:

2 years ago

I have relaxed the regex rules and updated the existing tests.
With the relaxed rules, should we reduce the number of test cases a little more?

#5 @desrosj
22 months ago

  • Version trunk deleted

@wildworks commented on PR #3097:

20 months ago

The problem this PR is trying to solve appears to have been fixed by Changeset 54117.
Therefore, I would like to close this PR.

#7 @wildworks
7 months ago

  • Resolution set to invalid
  • Status changed from new to closed

The issue reported in this ticket was reported in Changeset 54117, so could someone please close this ticket?

#8 @wildworks
7 months ago

  • Resolution invalid deleted
  • Status changed from closed to reopened

#9 @wildworks
8 weeks ago

  • Resolution set to duplicate
  • Status changed from reopened to closed

Duplicate of #56353.

#10 @SergeyBiryukov
8 weeks ago

  • Milestone Awaiting Review deleted

Related: [46793] / #48376.

Note: See TracTickets for help on using tickets.