Skip to content
Permalink
Browse files

KSES: Make the URI attributes DRY.

This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.


git-svn-id: https://develop.svn.wordpress.org/branches/5.0@44014 602fd350-edb4-49c9-b593-d223f7449a82
  • Loading branch information...
iandunn committed Dec 12, 2018
1 parent a2b0c8f commit 1d7b4a3655a15d5180ada23fc5073890a4e9497f
Showing with 52 additions and 2 deletions.
  1. +52 −2 src/wp-includes/kses.php
@@ -539,7 +539,7 @@ function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
* @return string Filtered attribute.
*/
function wp_kses_one_attr( $string, $element ) {
$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
$uris = wp_kses_uri_attributes();
$allowed_html = wp_kses_allowed_html( 'post' );
$allowed_protocols = wp_allowed_protocols();
$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
@@ -736,6 +736,56 @@ function wp_kses_split( $string, $allowed_html, $allowed_protocols ) {
return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $string );
}
/**
* Helper function listing HTML attributes containing a URL.
*
* This function returns a list of all HTML attributes that must contain
* a URL according to the HTML specification.
*
* This list includes URI attributes both allowed and disallowed by KSES.
*
* @link https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes
*
* @since 4.9.9
*
* @return array HTML attributes that must include a URL.
*/
function wp_kses_uri_attributes() {
$uri_attributes = array(
'action',
'archive',
'background',
'cite',
'classid',
'codebase',
'data',
'formaction',
'href',
'icon',
'longdesc',
'manifest',
'poster',
'profile',
'src',
'usemap',
'xmlns',
);
/**
* Filters the list of attributes that are required to contain a URL.
*
* Use this filter to add any `data-` attributes that are required to be
* validated as a URL.
*
* @since 4.9.9
*
* @param array $uri_attributes HTML attributes requiring validation as a URL.
*/
$uri_attributes = apply_filters( 'wp_kses_uri_attributes', $uri_attributes );
return $uri_attributes;
}
/**
* Callback for wp_kses_split.
*
@@ -953,7 +1003,7 @@ function wp_kses_hair($attr, $allowed_protocols) {
$attrarr = array();
$mode = 0;
$attrname = '';
$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
$uris = wp_kses_uri_attributes();
// Loop through the whole attribute list

0 comments on commit 1d7b4a3

Please sign in to comment.
You can’t perform that action at this time.