[wp-trac] [WordPress Trac] #65270: wp_kses() corrupts valid CSS background-image: url(...) declarations into style=")" 7.0-RC4

[WordPress Trac]

#65270: wp_kses() corrupts valid CSS background-image: url(...) declarations into
style=")" 7.0-RC4
----------------------------------------+---------------------
 Reporter:  nextendweb                  |       Owner:  (none)
     Type:  defect (bug)                |      Status:  new
 Priority:  normal                      |   Milestone:  7.0.1
Component:  Formatting                  |     Version:  7.0
 Severity:  normal                      |  Resolution:
 Keywords:  has-patch needs-unit-tests  |     Focuses:
----------------------------------------+---------------------

Comment (by ekamran):

 == Test Report ==

 Patch tested: https://github.com/WordPress/wordpress-develop/pull/11868

 === Environment ===

 * WordPress: 7.1-alpha-62161-src
 * PHP: 8.3.31
 * Environment: wordpress-develop local Docker environment
 * Test method: WP-CLI `wp eval` automated input/output checks
 * OS: macOS

 === Results ===

 I was able to reproduce the malformed CSS output on clean trunk.

 Before applying the patch, the tested cases returned:

 {{{
 {
   "single_quoted_url": "<div style=\")\"></div>",
   "entity_quoted_url": "<div style=\")\"></div>",
   "url_with_query_ampersand": "<div></div>",
   "url_plus_background_size": "<div style=\");background-
 size:cover\"></div>"
 }
 }}}

 After applying PR #11868 locally, the same cases returned valid sanitized
 output:

 {{{
 {
   "single_quoted_url": "<div style=\"background-image:
 url('https://localhost/image.jpg')\"></div>",
   "entity_quoted_url": "<div style=\"background-image:
 url("https://localhost/image.jpg")\"></div>",
   "url_with_query_ampersand": "<div style=\"background-image:
 url(https://localhost/image.jpg?a=1&b=2)\"></div>",
   "url_plus_background_size": "<div style=\"background-
 image:url('https://localhost/image.jpg');background-
 size:cover\"></div>"
 }
 }}}

 I also ran the existing KSES PHPUnit tests with the patch applied:

 {{{
 npm run test:php -- --filter Tests_Kses

 OK (414 tests, 1364 assertions)
 }}}

 === Notes ===

 The patch fixes the malformed `style=")"` output in the tested cases and
 preserves/escapes valid CSS URL values correctly.

 Dedicated unit test coverage is still needed for these cases.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65270#comment:9>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform