Make WordPress Core

Changes between Initial Version and Version 1 of Ticket #65717, comment 3


Ignore:
Timestamp:
08/04/2026 04:58:28 PM (2 months ago)
Author:
dmsnell

Legend:

Unmodified
Added
Removed
Modified
  • Ticket #65717, comment 3

    initial v1  
    55on the one hand, we are discussing in this ticket an attribute which ought to be globally allowed because we expect unprivileged authors to add accessibility attributes and don’t want to reject those. on the other hand, `wp_kses()` is a security system meant to prevent unsafe or unrecognized behaviors.
    66
    7 The HTML specification now has [sanitization mechanisms](https://html.spec.whatwg.org/#sanitization-algorithms) which may be worth exploring to see how browsers are handling this.
     7The HTML specification now has [https://html.spec.whatwg.org/#sanitization-algorithms sanitization mechanisms] which may be worth exploring to see how browsers are handling this.
    88
    99It would need to be verified though that someone without `unfiltered_html` can safely set `autofocus` and that won’t cause issues. //Then// it would need to be discussed if `wp_kses()` should add implicit special-cases for things like this, which would remove some control from the calling code (since `wp_kses()` is currently general purpose).