[wp-trac] [WordPress Trac] #65270: wp_kses() corrupts valid CSS background-image: url(...) declarations into style=")" 7.0-RC4

[WordPress Trac]

#65270: wp_kses() corrupts valid CSS background-image: url(...) declarations into
style=")" 7.0-RC4
--------------------------+---------------------
 Reporter:  nextendweb    |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  7.0.1
Component:  Formatting    |     Version:  trunk
 Severity:  normal        |  Resolution:
 Keywords:  needs-patch   |     Focuses:
--------------------------+---------------------
Changes (by westonruter):

 * keywords:   => needs-patch
 * severity:  major => normal
 * milestone:  Awaiting Review => 7.0.1


Comment:

 I just tried this with adding a background image to a Group block as an
 author role user, and it didn't cause the issue. This appears to be
 because the background image is not actually added as an inline style in
 the block markup:


 {{{
 <!-- wp:group
 {"style":{"background":{"backgroundImage":{"url":"http://localhost:8000
 /wp-content/uploads/2025/11/Bison_with_its_young-
 2560w.jpg","id":37,"source":"file","title":"Bison_with_its_young-
 2560w"},"backgroundSize":"cover"}},"layout":{"type":"constrained"}} -->
 <div class="wp-block-group"><!-- wp:paragraph -->
 <p>Hey!</p>
 <!-- /wp:paragraph --></div>
 <!-- /wp:group -->
 }}}

 Rendered start tag:

 {{{
 <div style="background-image:url('http://localhost:8000/wp-
 content/uploads/2025/11/Bison_with_its_young-2560w.jpg');background-
 size:cover;" class="wp-block-group has-global-padding is-layout-
 constrained wp-block-group-is-layout-constrained has-background">
 }}}

 ''However'', if I copy the rendered HTML of the Group block and paste it
 into a Custom HTML block, then indeed I can reproduce the issue:

 {{{
 <div style=");background-size:cover" class="wp-block-group has-global-
 padding is-layout-constrained wp-block-group-is-layout-constrained has-
 background">
 }}}

 So I don't think this will cause issues for most users, but it is
 definitely a bug that needs to be fixed.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65270#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform