Make WordPress Core

Opened 4 years ago

Last modified 15 months ago

#57246 new defect (bug)

Duotone SVG function does not check for CSS variable color format

Reported by: mattf10 Owned by:
Priority: normal Milestone: Awaiting Review
Component: General Version:
Severity: normal Keywords: needs-patch needs-test-info reporter-feedback
Cc: Focuses: css

Description (last modified by sabernhardt)

The function wp_get_duotone_filter_svg and/or wp_tinycolor_string_to_rgb do not verify the format of the color code passed to it. My theme uses a CSS variable var(--nv-text-dark-bg). After getting $color from wp_tinycolor_string_to_rgb, it assumes the color array has valid values. Since the original color is not one of the expected formats, this generates the following warnings:

PHP Warning:  Trying to access array offset on value of type null in /wp-includes/block-supports/duotone.php on line 422
PHP message: PHP Warning:  Trying to access array offset on value of type null in /wp-includes/block-supports/duotone.php on line 423
PHP message: PHP Warning:  Trying to access array offset on value of type null in /wp-includes/block-supports/duotone.php on line 424
PHP message: PHP Warning:  Trying to access array offset on value of type null in /wp-includes/block-supports/duotone.php on line 425

Please change one or the other method to check for CSS variables before using values from $color array.

Change History (5)

#1 @mattf10
4 years ago

  • Summary Duotune filter svg assumes hexDuotune filter svg does not check for css var color format

#2 @sabernhardt
4 years ago

  • Component GeneralThemes
  • Description modified (diff)
  • Focuses css added
  • Keywords needs-patch added
  • Summary Duotune filter svg does not check for css var color formatDuotone SVG function does not check for CSS variable color format

Hi and thanks for the report!

I have similar warnings when I add a Cover block with duotone in the Neve theme.

#3 @sabernhardt
4 years ago

  • Description modified (diff)

#4 @poena
19 months ago

  • Component ThemesGeneral
  • Keywords needs-testing-info reporter-feedback added

wp_get_duotone_filter_svg and wp_tinycolor_string_to_rgb were deprecated in WordPress 6.3.0.
https://core.trac.wordpress.org/ticket/58555

@mattf10 I don't believe this issue was resolved with the updated code. But I would need more detailed reproduction steps to test it.

#5 @wordpressdotorg
15 months ago

  • Keywords needs-test-info added; needs-testing-info removed
Note: See TracTickets for help on using tickets.