Opened 5 weeks ago
Last modified 8 days ago
#65795 new defect (bug)
Icons: Improve the SVG sanitizer in WP_Icons_Registry
| Reported by: | wildworks | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | 7.2 |
| Component: | Editor | Version: | |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description
- Follow-up to #64847.
- Gutenberg PR: https://github.com/WordPress/gutenberg/pull/75550
Core still has no dedicated SVG sanitization function, so the icons registry sanitizes icon content on its own. That sanitizer is incomplete: it strips attributes and elements that are valid SVG markup.
This ticket improves the sanitizer by extracting the root SVG element with WP_HTML_Processor before wp_kses() runs, and by expanding the allow-list to cover SVG-friendly elements and attributes.
Change History (2)
This ticket was mentioned in PR #12197 on WordPress/wordpress-develop by @wildworks.
5 weeks ago
#1
- Keywords has-patch has-unit-tests added
@mciampini commented on PR #12197:
8 days ago
#2
@t-hamano with https://github.com/WordPress/gutenberg/pull/78808 merged, can you take care of the Core side of things? Ie.
- rebase onto latest trunk
- Add https://github.com/WordPress/gutenberg/pull/78808 to its description (together with https://github.com/WordPress/gutenberg/pull/75550)
- Confirm its tests cover the stroke, style, vector-effect, and clip-rule attributes.
- Anything else to bring it up to date
Thank you 🙏
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
## Use of AI Tools
Used for: Initial code skeleton and test suggestions; final implementation and tests were reviewed and edited by me.