Twenty Seventeen: sanitize output of twentyseventeen_custom_colors_css()

[viralsampat]

Hello Team,

I have checked WordPress fork and found PHPCS Warning in functions.php file for "TwentySeventeen" theme.

i.e

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found 'twentyseventeen_custom_colors_css'.

<style type="text/css" id="custom-theme-colors" <?php echo $customize_preview_data_hue; ?>>
	<?php echo twentyseventeen_custom_colors_css(); ?>
</style>

Note: I have checked the core trac and found the similar issue. #62787

Thanks,

[viralsampat]

Hello Team,

I have added its PR, Please review it: PR​https://github.com/WordPress/wordpress-develop/pull/8108

Thanks,

Trac ticket: https://core.trac.wordpress.org/ticket/62798

This PR adds proper sanitization to the custom colors CSS output in the Twenty Seventeen theme. The twentyseventeen_custom_colors_css() function's output is filterable and currently outputs unsanitized content.

The PR wraps outputs with wp_strip_all_tags() to ensure only CSS is included, preventing potential injection of unwanted HTML through filters.

Thanks,

Trac ticket: https://core.trac.wordpress.org/ticket/62798

This PR adds proper sanitization to the custom colors CSS output in the Twenty Seventeen theme. The twentyseventeen_custom_colors_css() function's output is filterable and currently outputs unsanitized content.

The PR wraps outputs with wp_strip_all_tags() to ensure only CSS is included, preventing potential injection of unwanted HTML through filters.

Thanks,

[rishabhwp]

Reproduction Report

Description

This report validates whether the issue can be reproduced.

Environment

• WordPress: 6.9-alpha-60093-src
• PHP: 8.2.28
• Server: nginx/1.27.5
• Database: mysqli (Server: 8.4.5 / Client: mysqlnd 8.2.28)
• Browser: Chrome 137.0.0.0
• OS: macOS
• Theme: Twenty Seventeen 3.9
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.2.0

Steps to Reproduce

1. Activate the Twenty Seventeen theme.
2. Add a filter in functions.php:

add_filter( 'twentyseventeen_custom_colors_css', function( $css ) {
    return $css . '<script>console.log("XSS");</script>';
} );

3. Go to Appearance → Customize → Colors, adjust any custom color value (e.g., accent hue).
4. You will see a popup with "XSS".

Actual Results

1. ✅ Error condition occurs (reproduced).

Supplemental Artifacts

[rishabhwp]

Test Report

Description

This report validates whether the indicated patch works as expected.

Patch tested: ​https://github.com/WordPress/wordpress-develop/pull/8115.diff

Environment

• WordPress: 6.9-alpha-60093-src
• PHP: 8.2.28
• Server: nginx/1.27.5
• Database: mysqli (Server: 8.4.5 / Client: mysqlnd 8.2.28)
• Browser: Chrome 137.0.0.0
• OS: macOS
• Theme: Twenty Seventeen 3.9
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.2.0

Actual Results

1. ✅ Issue resolved with patch.

[SirLouen]

Replying to rishabhwp:

Test Report

@rishabhwp one little trick: There is a report called "Combined Bug Reproduction and Test Report", where you combine both reports, and it looks much better and all in one place (easier to read by future code reviewers). I recommend using this, here is an example

[rishabhwp]

Replying to SirLouen:
Thanks a lot for the suggestion! The combined report format looks much more organized and easier to follow. I’ll make sure to use it going forward.