Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add: Save time theme.json escaping #28061

Merged
merged 4 commits into from
Jan 13, 2021

Conversation

jorgefilipecosta
Copy link
Member

@jorgefilipecosta jorgefilipecosta commented Jan 8, 2021

This PR adds save time escaping of the user theme.json.

It tries to follow what was done for HTML post content escaping in src/wp-includes/kses.php.
Like KSES we rely on the content_save_pre filter to escape the content of the post.
Here comes the first challenge, code executing inside of that filter does not have access to the post type being escaped. The filter just receives the content and should output escaped content. So we need some way to given a post content string, identify if it is a user theme.json content.
The way we are doing this is by including a flag isGlobalStylesUserThemeJSON in the user theme.json, which marks if the content of the post is a user theme.json.

Our code totally ignores the user JSON if the flag is not present as in that case the content can not be considered safe.
To filter what CSS is possible we rely on safecss_filter_attr. If a rule is removed by safecss_filter_attr we discard it from the user theme.json.

How has this been tested?

Try to inject unsafe rules, e.g: SVG backgrounds in the gradients, and verify these rules are removed.
To make it easier to test, this PR is escaping styles submitted by an admin "! current_user_can( 'unfiltered_html' ) || true " the "|| true " should be removed before the merge.

@github-actions
Copy link

github-actions bot commented Jan 8, 2021

Size Change: -20.8 kB (-2%)

Total Size: 1.28 MB

Filename Size Change
build/annotations/index.js 3.8 kB -3 B (0%)
build/autop/index.js 2.83 kB -1 B (0%)
build/blob/index.js 665 B +1 B (0%)
build/block-directory/index.js 9.03 kB -9 B (0%)
build/block-editor/index.js 121 kB -9.11 kB (-7%)
build/block-editor/style-rtl.css 11.5 kB +169 B (+1%)
build/block-editor/style.css 11.5 kB +171 B (+2%)
build/block-library/blocks/cover/style-rtl.css 1.32 kB -6 B (0%)
build/block-library/blocks/cover/style.css 1.32 kB -5 B (0%)
build/block-library/blocks/spacer/editor-rtl.css 391 B +1 B (0%)
build/block-library/blocks/spacer/editor.css 391 B +1 B (0%)
build/block-library/blocks/verse/style-rtl.css 215 B +1 B (0%)
build/block-library/blocks/verse/style.css 215 B +1 B (0%)
build/block-library/editor-rtl.css 8.94 kB +1 B (0%)
build/block-library/editor.css 8.94 kB +2 B (0%)
build/block-library/index.js 141 kB -9.57 kB (-6%)
build/block-library/style-rtl.css 8.52 kB -8 B (0%)
build/block-library/style.css 8.52 kB -11 B (0%)
build/blocks/index.js 48.1 kB +97 B (0%)
build/components/index.js 173 kB +884 B (+1%)
build/core-data/index.js 15.2 kB +54 B (0%)
build/data-controls/index.js 829 B -1 B (0%)
build/data/index.js 8.97 kB +6 B (0%)
build/date/index.js 31.8 kB -3 B (0%)
build/dom/index.js 4.95 kB +1 B (0%)
build/edit-navigation/index.js 11.1 kB +10 B (0%)
build/edit-post/index.js 306 kB +104 B (0%)
build/edit-post/style-rtl.css 6.56 kB -81 B (-1%)
build/edit-post/style.css 6.55 kB -78 B (-1%)
build/edit-site/index.js 24.2 kB -274 B (-1%)
build/edit-site/style-rtl.css 4 kB -37 B (-1%)
build/edit-site/style.css 4 kB -37 B (-1%)
build/edit-widgets/index.js 23.6 kB -2.46 kB (-9%)
build/edit-widgets/style-rtl.css 3.16 kB -58 B (-2%)
build/edit-widgets/style.css 3.16 kB -57 B (-2%)
build/editor/index.js 42.3 kB -478 B (-1%)
build/element/index.js 4.62 kB +1 B (0%)
build/format-library/index.js 6.75 kB +2 B (0%)
build/hooks/index.js 2.27 kB +2 B (0%)
build/i18n/index.js 3.57 kB -1 B (0%)
build/keyboard-shortcuts/index.js 2.54 kB -1 B (0%)
build/keycodes/index.js 1.94 kB -1 B (0%)
build/media-utils/index.js 5.31 kB -5 B (0%)
build/notices/index.js 1.86 kB +1 B (0%)
build/nux/index.js 3.42 kB -5 B (0%)
build/priority-queue/index.js 789 B -1 B (0%)
build/reusable-blocks/index.js 2.91 kB -2 B (0%)
build/rich-text/index.js 13.5 kB +31 B (0%)
build/server-side-render/index.js 2.77 kB -4 B (0%)
build/shortcode/index.js 1.7 kB +1 B (0%)
build/token-list/index.js 1.27 kB -1 B (0%)
build/url/index.js 3.01 kB -8 B (0%)
build/viewport/index.js 1.85 kB -5 B (0%)
build/wordcount/index.js 1.22 kB +1 B (0%)
ℹ️ View Unchanged
Filename Size Change
build/a11y/index.js 1.14 kB 0 B
build/api-fetch/index.js 3.42 kB 0 B
build/block-directory/style-rtl.css 1.01 kB 0 B
build/block-directory/style.css 1.01 kB 0 B
build/block-library/blocks/archives/editor-rtl.css 196 B 0 B
build/block-library/blocks/archives/editor.css 196 B 0 B
build/block-library/blocks/audio/editor-rtl.css 194 B 0 B
build/block-library/blocks/audio/editor.css 194 B 0 B
build/block-library/blocks/audio/style-rtl.css 225 B 0 B
build/block-library/blocks/audio/style.css 225 B 0 B
build/block-library/blocks/block/editor-rtl.css 283 B 0 B
build/block-library/blocks/block/editor.css 283 B 0 B
build/block-library/blocks/button/editor-rtl.css 576 B 0 B
build/block-library/blocks/button/editor.css 577 B 0 B
build/block-library/blocks/button/style-rtl.css 552 B 0 B
build/block-library/blocks/button/style.css 552 B 0 B
build/block-library/blocks/buttons/editor-rtl.css 345 B 0 B
build/block-library/blocks/buttons/editor.css 346 B 0 B
build/block-library/blocks/buttons/style-rtl.css 419 B 0 B
build/block-library/blocks/buttons/style.css 419 B 0 B
build/block-library/blocks/calendar/style-rtl.css 319 B 0 B
build/block-library/blocks/calendar/style.css 319 B 0 B
build/block-library/blocks/categories/editor-rtl.css 210 B 0 B
build/block-library/blocks/categories/editor.css 209 B 0 B
build/block-library/blocks/categories/style-rtl.css 208 B 0 B
build/block-library/blocks/categories/style.css 208 B 0 B
build/block-library/blocks/code/style-rtl.css 216 B 0 B
build/block-library/blocks/code/style.css 216 B 0 B
build/block-library/blocks/columns/editor-rtl.css 300 B 0 B
build/block-library/blocks/columns/editor.css 299 B 0 B
build/block-library/blocks/columns/style-rtl.css 529 B 0 B
build/block-library/blocks/columns/style.css 528 B 0 B
build/block-library/blocks/cover/editor-rtl.css 508 B 0 B
build/block-library/blocks/cover/editor.css 506 B 0 B
build/block-library/blocks/embed/editor-rtl.css 594 B 0 B
build/block-library/blocks/embed/editor.css 595 B 0 B
build/block-library/blocks/embed/style-rtl.css 489 B 0 B
build/block-library/blocks/embed/style.css 489 B 0 B
build/block-library/blocks/file/editor-rtl.css 314 B 0 B
build/block-library/blocks/file/editor.css 313 B 0 B
build/block-library/blocks/file/style-rtl.css 352 B 0 B
build/block-library/blocks/file/style.css 352 B 0 B
build/block-library/blocks/freeform/editor-rtl.css 2.55 kB 0 B
build/block-library/blocks/freeform/editor.css 2.55 kB 0 B
build/block-library/blocks/gallery/editor-rtl.css 749 B 0 B
build/block-library/blocks/gallery/editor.css 750 B 0 B
build/block-library/blocks/gallery/style-rtl.css 1.17 kB 0 B
build/block-library/blocks/gallery/style.css 1.17 kB 0 B
build/block-library/blocks/group/editor-rtl.css 433 B 0 B
build/block-library/blocks/group/editor.css 432 B 0 B
build/block-library/blocks/group/style-rtl.css 190 B 0 B
build/block-library/blocks/group/style.css 190 B 0 B
build/block-library/blocks/heading/editor-rtl.css 248 B 0 B
build/block-library/blocks/heading/editor.css 248 B 0 B
build/block-library/blocks/heading/style-rtl.css 212 B 0 B
build/block-library/blocks/heading/style.css 212 B 0 B
build/block-library/blocks/html/editor-rtl.css 384 B 0 B
build/block-library/blocks/html/editor.css 385 B 0 B
build/block-library/blocks/image/editor-rtl.css 801 B 0 B
build/block-library/blocks/image/editor.css 800 B 0 B
build/block-library/blocks/image/style-rtl.css 569 B 0 B
build/block-library/blocks/image/style.css 570 B 0 B
build/block-library/blocks/latest-comments/editor-rtl.css 277 B 0 B
build/block-library/blocks/latest-comments/editor.css 275 B 0 B
build/block-library/blocks/latest-comments/style-rtl.css 382 B 0 B
build/block-library/blocks/latest-comments/style.css 382 B 0 B
build/block-library/blocks/latest-posts/editor-rtl.css 254 B 0 B
build/block-library/blocks/latest-posts/editor.css 254 B 0 B
build/block-library/blocks/latest-posts/style-rtl.css 634 B 0 B
build/block-library/blocks/latest-posts/style.css 634 B 0 B
build/block-library/blocks/list/editor-rtl.css 203 B 0 B
build/block-library/blocks/list/editor.css 203 B 0 B
build/block-library/blocks/list/style-rtl.css 201 B 0 B
build/block-library/blocks/list/style.css 201 B 0 B
build/block-library/blocks/media-text/editor-rtl.css 311 B 0 B
build/block-library/blocks/media-text/editor.css 311 B 0 B
build/block-library/blocks/media-text/style-rtl.css 642 B 0 B
build/block-library/blocks/media-text/style.css 640 B 0 B
build/block-library/blocks/more/editor-rtl.css 545 B 0 B
build/block-library/blocks/more/editor.css 545 B 0 B
build/block-library/blocks/navigation-link/editor-rtl.css 503 B 0 B
build/block-library/blocks/navigation-link/editor.css 504 B 0 B
build/block-library/blocks/navigation-link/style-rtl.css 805 B 0 B
build/block-library/blocks/navigation-link/style.css 803 B 0 B
build/block-library/blocks/navigation/editor-rtl.css 1.38 kB 0 B
build/block-library/blocks/navigation/editor.css 1.38 kB 0 B
build/block-library/blocks/navigation/style-rtl.css 274 B 0 B
build/block-library/blocks/navigation/style.css 274 B 0 B
build/block-library/blocks/nextpage/editor-rtl.css 507 B 0 B
build/block-library/blocks/nextpage/editor.css 507 B 0 B
build/block-library/blocks/paragraph/editor-rtl.css 236 B 0 B
build/block-library/blocks/paragraph/editor.css 236 B 0 B
build/block-library/blocks/paragraph/style-rtl.css 351 B 0 B
build/block-library/blocks/paragraph/style.css 352 B 0 B
build/block-library/blocks/post-author/editor-rtl.css 329 B 0 B
build/block-library/blocks/post-author/editor.css 329 B 0 B
build/block-library/blocks/post-author/style-rtl.css 303 B 0 B
build/block-library/blocks/post-author/style.css 303 B 0 B
build/block-library/blocks/post-comments-form/style-rtl.css 358 B 0 B
build/block-library/blocks/post-comments-form/style.css 358 B 0 B
build/block-library/blocks/post-content/editor-rtl.css 262 B 0 B
build/block-library/blocks/post-content/editor.css 262 B 0 B
build/block-library/blocks/post-excerpt/editor-rtl.css 206 B 0 B
build/block-library/blocks/post-excerpt/editor.css 206 B 0 B
build/block-library/blocks/post-featured-image/editor-rtl.css 453 B 0 B
build/block-library/blocks/post-featured-image/editor.css 453 B 0 B
build/block-library/blocks/post-featured-image/style-rtl.css 223 B 0 B
build/block-library/blocks/post-featured-image/style.css 223 B 0 B
build/block-library/blocks/preformatted/style-rtl.css 193 B 0 B
build/block-library/blocks/preformatted/style.css 193 B 0 B
build/block-library/blocks/pullquote/editor-rtl.css 304 B 0 B
build/block-library/blocks/pullquote/editor.css 304 B 0 B
build/block-library/blocks/pullquote/style-rtl.css 428 B 0 B
build/block-library/blocks/pullquote/style.css 428 B 0 B
build/block-library/blocks/query-loop/editor-rtl.css 217 B 0 B
build/block-library/blocks/query-loop/editor.css 216 B 0 B
build/block-library/blocks/query-loop/style-rtl.css 427 B 0 B
build/block-library/blocks/query-loop/style.css 429 B 0 B
build/block-library/blocks/query/editor-rtl.css 279 B 0 B
build/block-library/blocks/query/editor.css 279 B 0 B
build/block-library/blocks/quote/editor-rtl.css 195 B 0 B
build/block-library/blocks/quote/editor.css 195 B 0 B
build/block-library/blocks/quote/style-rtl.css 284 B 0 B
build/block-library/blocks/quote/style.css 285 B 0 B
build/block-library/blocks/rss/editor-rtl.css 307 B 0 B
build/block-library/blocks/rss/editor.css 309 B 0 B
build/block-library/blocks/rss/style-rtl.css 394 B 0 B
build/block-library/blocks/rss/style.css 393 B 0 B
build/block-library/blocks/search/editor-rtl.css 285 B 0 B
build/block-library/blocks/search/editor.css 285 B 0 B
build/block-library/blocks/search/style-rtl.css 454 B 0 B
build/block-library/blocks/search/style.css 456 B 0 B
build/block-library/blocks/separator/editor-rtl.css 229 B 0 B
build/block-library/blocks/separator/editor.css 229 B 0 B
build/block-library/blocks/separator/style-rtl.css 352 B 0 B
build/block-library/blocks/separator/style.css 352 B 0 B
build/block-library/blocks/shortcode/editor-rtl.css 603 B 0 B
build/block-library/blocks/shortcode/editor.css 603 B 0 B
build/block-library/blocks/site-logo/editor-rtl.css 321 B 0 B
build/block-library/blocks/site-logo/editor.css 321 B 0 B
build/block-library/blocks/site-logo/style-rtl.css 238 B 0 B
build/block-library/blocks/site-logo/style.css 238 B 0 B
build/block-library/blocks/social-link/editor-rtl.css 283 B 0 B
build/block-library/blocks/social-link/editor.css 283 B 0 B
build/block-library/blocks/social-links/editor-rtl.css 811 B 0 B
build/block-library/blocks/social-links/editor.css 810 B 0 B
build/block-library/blocks/social-links/style-rtl.css 1.44 kB 0 B
build/block-library/blocks/social-links/style.css 1.44 kB 0 B
build/block-library/blocks/spacer/style-rtl.css 184 B 0 B
build/block-library/blocks/spacer/style.css 184 B 0 B
build/block-library/blocks/subhead/editor-rtl.css 223 B 0 B
build/block-library/blocks/subhead/editor.css 223 B 0 B
build/block-library/blocks/subhead/style-rtl.css 210 B 0 B
build/block-library/blocks/subhead/style.css 210 B 0 B
build/block-library/blocks/table/editor-rtl.css 593 B 0 B
build/block-library/blocks/table/editor.css 593 B 0 B
build/block-library/blocks/table/style-rtl.css 501 B 0 B
build/block-library/blocks/table/style.css 501 B 0 B
build/block-library/blocks/tag-cloud/editor-rtl.css 237 B 0 B
build/block-library/blocks/tag-cloud/editor.css 235 B 0 B
build/block-library/blocks/tag-cloud/style-rtl.css 221 B 0 B
build/block-library/blocks/tag-cloud/style.css 221 B 0 B
build/block-library/blocks/template-part/editor-rtl.css 714 B 0 B
build/block-library/blocks/template-part/editor.css 714 B 0 B
build/block-library/blocks/text-columns/editor-rtl.css 220 B 0 B
build/block-library/blocks/text-columns/editor.css 220 B 0 B
build/block-library/blocks/text-columns/style-rtl.css 283 B 0 B
build/block-library/blocks/text-columns/style.css 283 B 0 B
build/block-library/blocks/verse/editor-rtl.css 194 B 0 B
build/block-library/blocks/verse/editor.css 194 B 0 B
build/block-library/blocks/video/editor-rtl.css 617 B 0 B
build/block-library/blocks/video/editor.css 617 B 0 B
build/block-library/blocks/video/style-rtl.css 303 B 0 B
build/block-library/blocks/video/style.css 304 B 0 B
build/block-library/common-rtl.css 1.01 kB 0 B
build/block-library/common.css 1.01 kB 0 B
build/block-library/theme-rtl.css 860 B 0 B
build/block-library/theme.css 860 B 0 B
build/block-serialization-default-parser/index.js 1.88 kB 0 B
build/block-serialization-spec-parser/index.js 3.06 kB 0 B
build/components/style-rtl.css 15.5 kB 0 B
build/components/style.css 15.5 kB 0 B
build/compose/index.js 11.2 kB 0 B
build/deprecated/index.js 768 B 0 B
build/dom-ready/index.js 571 B 0 B
build/edit-navigation/style-rtl.css 938 B 0 B
build/edit-navigation/style.css 944 B 0 B
build/editor/editor-styles-rtl.css 476 B 0 B
build/editor/editor-styles.css 478 B 0 B
build/editor/style-rtl.css 3.89 kB 0 B
build/editor/style.css 3.89 kB 0 B
build/escape-html/index.js 735 B 0 B
build/format-library/style-rtl.css 620 B 0 B
build/format-library/style.css 621 B 0 B
build/html-entities/index.js 623 B 0 B
build/is-shallow-equal/index.js 698 B 0 B
build/list-reusable-blocks/index.js 3.15 kB 0 B
build/list-reusable-blocks/style-rtl.css 629 B 0 B
build/list-reusable-blocks/style.css 628 B 0 B
build/nux/style-rtl.css 731 B 0 B
build/nux/style.css 727 B 0 B
build/plugins/index.js 2.54 kB 0 B
build/primitives/index.js 1.43 kB 0 B
build/redux-routine/index.js 2.84 kB 0 B
build/warning/index.js 1.14 kB 0 B

compressed-size-action

*/
function gutenberg_global_styles_kses_init() {
gutenberg_global_styles_kses_remove_filters();
if ( ! current_user_can( 'unfiltered_html' ) || true ) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This if condition is always true.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @Soean, that was done on purpose to make it easier to test the PR, without needing a multisite where admin doesn't have an unfiltered HTML capability, or without using a plugin that removes the capability. Before merging the PR the "|| true" should be removed.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps we can remove the true condition from this code and add it to the testing instructions? We need to test both that users can and can't store that data depending on their capabilities.

@oandregal
Copy link
Member

Hey, I've taken a first look at this. I want to review further the part of this PR that deals with hooking into the content_save_pre filter, so will give feedback about this a bit later.

Here's my feedback about the other two things this PR does:

  • I like that the implementation of remove_insecure_properties considers more use cases than what we have in process_key with the should_escape flag. It doesn't seem that we need both mechanisms, though. I'm also thinking that dealing with this via constructor is a better way than having a separate public API method. So, what would you think of creating a separate PR that just updates the code in process_key?

  • For the safecss_filter_attr_allow_css filter. I understand this is trying to fix the situation in which a block style has a custom value for presets. At the moment, this only happens for the font-family in the site-editor. We also have a highly related issue with link colors not working for non-admin roles Link color doesn't work for author role #25151. In the interest of velocity and having nice, well-scoped PR, do you think we can take this code, revive/combine it with what we had at Fix link color for roles without unfiltered_html capabilities #25411 and create a separate PR to deal with this?

@jorgefilipecosta
Copy link
Member Author

For the safecss_filter_attr_allow_css filter. I understand this is trying to fix the situation in which a block style has a custom value for presets. At the moment, this only happens for the font-family in the site-editor

Hi @nosolosw, it happens on every preset. When we apply a background color for global the style generated is:

:root {
	background-color: var(--wp--...)
}

You are right it is a different issue, would you prefer to separate that part of this PR in a dependent PR? We would need to merge that PR first.

@jorgefilipecosta
Copy link
Member Author

I like that the implementation of remove_insecure_properties considers more use cases than what we have in process_key with the should_escape flag. It doesn't seem that we need both mechanisms, though. I'm also thinking that dealing with this via constructor is a better way than having a separate public API method. So, what would you think of creating a separate PR that just updates the code in process_key?

Hi @nosolosw, I guess we could remove the process_key function and the process_key calls?
ll our escaping needs seem to be covered in this PR. And the current process_key methodology does not allow unfiltered styles by users with that ability.
The approach used in this PR can not be applied inside a process_key call. In this PR I don't escape individual style keys, I just generate the styles using the normal function compute_style_properties, and then allow the keys that generated a valid safe style, cleaning all the rest (keys that did not output any style or unsafe keys).

Copy link
Member

@oandregal oandregal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was able to read the other part of the code and this seems fine. I wasn't able to test all the use cases this addresses, though (don't know how to test the import case, for example). I think this is important to merge and test widely in the coming days, so I'm approving.

I'd like to see these follow-ups (the smaller the PR the easier/quicker to review/land):

  • Add tests.

  • The presets listed here need to be taken from the schema, so adding a new preset doesn't require touching multiple files (so people will forget).

  • We need to merge process_key & remove_insecure_properties.

I've also got a couple of questions about how we use isGlobalStylesUserThemeJSON:

  • We seem to use this flag to signal both that the data is a CPT coming from the user & that the data has been sanitized. Do you think it makes sense to have separate flags instead? isUserData and isSanitized for example.

  • On the other hand, I haven't seen that we check that a post is sanitized before using it, so I'm not sure we need this and this. What do you think?

@oandregal
Copy link
Member

I've started to create follow-ups: #28171

@oandregal oandregal merged commit f27ea4d into master Jan 13, 2021
@oandregal oandregal deleted the update/save-time-theme-json-escaping branch January 13, 2021 18:12
@github-actions github-actions bot added this to the Gutenberg 9.8 milestone Jan 13, 2021
@jorgefilipecosta
Copy link
Member Author

jorgefilipecosta commented Jan 13, 2021

Hi @nosolosw,

I've also got a couple of questions about how we use isGlobalStylesUserThemeJSON:

This flag is really important and we should decide well on its name as we can not easily change it. It is stored in the database and we need to be back-compatible with it.

In fact, I wonder if as part of theme.json versioning it also makes sense to save a version on the database, so we are back-compatible with old user data?

We seem to use this flag to signal both that the data is a CPT coming from the user & that the data has been sanitized. Do you think it makes sense to have separate flags instead? isUserData and isSanitized for example.

This flag indicates that it is a user theme.json. If it is a user theme.json it is sanitized or not depending on the user capabilities and conditions/plugins being present on the save moment. I don't think a isSanitized flag is useful at all.
Is there any use case where you think isSanitized flag could be helpful?

On the other hand, I haven't seen that we check that a post is sanitized before using it, so I'm not sure we need this and this. What do you think?

We need to check if the flag is preset or not. On HTML content there is no need to check because the filters always run (depending just on user capabilities). We can not run our filters unconditionally as otherwise, we may change JSON data from another plugin for example. If the flag is not preset the content can not be presumed to be safe, so before using we need to verify if the flag is there.
Otherwise, an attacker could create a JSON structure with unallowed styles but without the flag. The content would not be sanitized but would end up being used anyway and our theme.json system would output styles that the user was no permission to do it.

@oandregal
Copy link
Member

Follow-up #28188

@jorgefilipecosta would you think you are able to add tests for this in a new PR? I can take care of the other follow-ups in some PRs I'm working on.

@jorgefilipecosta
Copy link
Member Author

Hi @nosolosw,
Thank you for taking care of the other follow-ups.
I will work on adding the test cases.

@oandregal oandregal mentioned this pull request Mar 11, 2021
82 tasks
pento pushed a commit to WordPress/wordpress-develop that referenced this pull request Nov 8, 2021
This commit adds global styles user content escaping. In addition, it ports the logic on the Gutenberg plugin implemented on WordPress/gutenberg#28061 to the core.
The logic tries to follow what was done for standard post content.

See #54336.
Props oandregal.

git-svn-id: https://develop.svn.wordpress.org/trunk@52052 602fd350-edb4-49c9-b593-d223f7449a82
nylen pushed a commit to nylen/wordpress-develop-svn that referenced this pull request Nov 8, 2021
This commit adds global styles user content escaping. In addition, it ports the logic on the Gutenberg plugin implemented on WordPress/gutenberg#28061 to the core.
The logic tries to follow what was done for standard post content.

See #54336.
Props oandregal.

git-svn-id: https://develop.svn.wordpress.org/trunk@52052 602fd350-edb4-49c9-b593-d223f7449a82
markjaquith pushed a commit to markjaquith/WordPress that referenced this pull request Nov 8, 2021
This commit adds global styles user content escaping. In addition, it ports the logic on the Gutenberg plugin implemented on WordPress/gutenberg#28061 to the core.
The logic tries to follow what was done for standard post content.

See #54336.
Props oandregal.
Built from https://develop.svn.wordpress.org/trunk@52052


git-svn-id: http://core.svn.wordpress.org/trunk@51644 1a063a9b-81f0-0310-95a4-ce76da25c4cd
gMagicScott pushed a commit to gMagicScott/core.wordpress-mirror that referenced this pull request Nov 8, 2021
This commit adds global styles user content escaping. In addition, it ports the logic on the Gutenberg plugin implemented on WordPress/gutenberg#28061 to the core.
The logic tries to follow what was done for standard post content.

See #54336.
Props oandregal.
Built from https://develop.svn.wordpress.org/trunk@52052


git-svn-id: https://core.svn.wordpress.org/trunk@51644 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants