KSES: Allow CSS color functions in inline styles

[aaronrobertshaw]

Backport of Gutenberg PR ​https://github.com/WordPress/gutenberg/pull/84213.

safecss_filter_attr() drops any declaration whose value uses a CSS color function, such as rgb(), hsl(), oklch() or color-mix(). So box-shadow: 1px 1px 1px rgba(0,0,0,0.5) never reaches the page. The same goes for a shadow or text color from the style engine.

It removes a color function from the test string, innermost first, only when its contents are plain color syntax. Anything left over, such as a parenthesis, backslash, comment or unknown function, is still rejected. The check runs before the safecss_filter_attr_allow_css filter, so a plugin can still reject the declaration.

Backport of Gutenberg PR ​https://github.com/WordPress/gutenberg/pull/84213

Trac ticket: https://core.trac.wordpress.org/ticket/66387

safecss_filter_attr() drops any declaration that uses a CSS color function, such as rgba() in a box-shadow. This keeps a color function when its contents are plain color syntax.

This PR backports:

• the color function check in safecss_filter_attr(), alongside the existing var(), calc() and similar handling,
• and the accompanying kses tests, including a safecss_filter_attr_allow_css filter still rejecting the result.

The Gutenberg PR added this as a filter. In Core it is part of the function itself, so the filter sees the result of the check.

Testing instructions

1. Log in as an Author, so post content goes through KSES.
2. Create a post and, in the code editor, add:

   <p class="has-text-color" style="color:color-mix(in srgb, #c00 70%, #000);box-shadow:6px 6px 9px rgba(0,0,0,0.5)">Color functions</p>
   

3. Save and reload. The shadow and text color still apply, in the editor and on the front end. On trunk both are stripped on save.
4. Run the new tests with npm run test:php -- --group 66387.

Use of AI

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: The mechanical port and tests; I reviewed and edited them.