![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 4 weeks ago
Closed 3 weeks ago
#65457 closed defect (bug) (fixed)
KSES: Inline styles related to SVG will be removed
| Reported by: | wildworks | Owned by: | wildworks |
|---|---|---|---|
| Priority: | normal | Milestone: | 7.1 |
| Component: | Formatting | Version: | |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description
This issue was discovered when attempting to change the icon rendering method in the icon registry.
https://github.com/WordPress/gutenberg/pull/78808#discussion_r3403282263
wp_kses() runs the style attribute through safecss_filter_attr(), which only keeps an allowlist of CSS properties. SVG presentation attributes are not in that list, so inline styles get stripped during sanitization.
This issue may become more prominent once stroke-based icons are implemented by https://github.com/WordPress/gutenberg/pull/78808 or custom icons are allowed to be registered by https://github.com/WordPress/gutenberg/pull/77260.
Change History (4)
This ticket was mentioned in PR #12169 on WordPress/wordpress-develop by @wildworks.
4 weeks ago
#1
- Keywords has-patch has-unit-tests added
@afercia commented on PR #12169:
4 weeks ago
#2
Please see a couple comments on the related Gutenberg PR:
https://github.com/WordPress/gutenberg/pull/79172#issuecomment-4706573926
https://github.com/WordPress/gutenberg/pull/79172#issuecomment-4706613135
SVG markup sanitized with
wp_kses()loses its inline styles becausesafecss_filter_attr()only keeps an allowlist of CSS properties, and SVG presentation attributes (fill,stroke, etc.) are not on it. As stroke-based and custom block icons become more common, preserving these styles matters.This adds the SVG presentation attributes to the
safe_style_cssallowlist so they survive sanitization, and adds test coverage for them. The attribute list is based on the SVG presentation attributes documented on MDN.Ports WordPress/gutenberg#79172 to Core.
## Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 4.8
Used for: Porting the Gutenberg change and drafting tests; all changes were reviewed and edited by me.