Make WordPress Core

Opened 5 weeks ago

Last modified 8 days ago

#65795 new defect (bug)

Icons: Improve the SVG sanitizer in WP_Icons_Registry

Reported by: wildworks Owned by:
Priority: normal Milestone: 7.2
Component: Editor Version:
Severity: normal Keywords: has-patch has-unit-tests
Cc: Focuses:

Description

Core still has no dedicated SVG sanitization function, so the icons registry sanitizes icon content on its own. That sanitizer is incomplete: it strips attributes and elements that are valid SVG markup.

This ticket improves the sanitizer by extracting the root SVG element with WP_HTML_Processor before wp_kses() runs, and by expanding the allow-list to cover SVG-friendly elements and attributes.

Change History (2)

This ticket was mentioned in PR #12197 on WordPress/wordpress-develop by @wildworks.


5 weeks ago
#1

  • Keywords has-patch has-unit-tests added

## Use of AI Tools

Used for: Initial code skeleton and test suggestions; final implementation and tests were reviewed and edited by me.

@mciampini commented on PR #12197:


8 days ago
#2

@t-hamano with https://github.com/WordPress/gutenberg/pull/78808 merged, can you take care of the Core side of things? Ie.

Thank you 🙏

Note: See TracTickets for help on using tickets.