wp_kses breaking text fragments links

[asafm7]

Hello.

It seems that wp_kses() (probably wp_kses_bad_protocol()) is breaking text fragments links (​https://developer.mozilla.org/en-US/docs/Web/Text_fragments).

For example:
<a href="#:~:text=highlight>Link</a>

This issue became more prominent as recently ACF started escaping HTML using the wp_kses() function (​https://www.advancedcustomfields.com/blog/acf-6-2-5-security-release/).

I confirmed the issue with ACF's support.

[asafm7]

I forgot to mention that it only happens to relative links, without a protocol.

Like in the example I provided:

<a href="#:~:text=highlight>Link</a>

[asafm7]

Hi, is there any way to promote a fix for this issue?

[shanemuir]

This patch fixes the issue where kses removes text fragment links (e.g., #:~:text) as invalid protocols. The fix adds a check in wp_kses_bad_protocol to allow such fragments. The patch also includes unit tests to verify the behavior.

[asafm7]

That's great. Thanks, @shanemuir.

Will this be a part of the next release?

[shanemuir]

Replying to asafm7:

That's great. Thanks, @shanemuir.

Will this be a part of the next release?

The patch will first need to undergo a review. If no issues are identified, it will then be assigned to a milestone, which will determine the future release in which this patch will be included.

This PR addresses the issue in Trac ticket #60347, where wp_kses() removes valid text fragment links (e.g., #:~:text=highlight) by treating them as invalid protocols.

Changes:

• Updated wp_kses_bad_protocol() in kses.php to explicitly allow text fragments (#:~:text).
• Added a unit test to verify that text fragments are preserved in the href attribute.

Testing:

1. Run npm run test:php to confirm all tests pass.
2. Apply the patch and manually test with an anchor tag containing #:~:text in the href attribute.

• Example: <a href="#:~:text=highlight">Link</a> should pass validation.

Impact:

This change ensures that text fragment links are correctly preserved by wp_kses(), aligning with modern URL standards and avoiding unnecessary sanitization.

Trac ticket: https://core.trac.wordpress.org/ticket/60347