[wp-trac] [WordPress Trac] #65270: wp_kses() corrupts valid CSS background-image: url(...) declarations into style=")" 7.0-RC4

[WordPress Trac]

#65270: wp_kses() corrupts valid CSS background-image: url(...) declarations into
style=")" 7.0-RC4
----------------------------------------+----------------------
 Reporter:  nextendweb                  |       Owner:  dmsnell
     Type:  defect (bug)                |      Status:  closed
 Priority:  normal                      |   Milestone:  7.0.1
Component:  Formatting                  |     Version:  7.0
 Severity:  normal                      |  Resolution:  fixed
 Keywords:  has-patch needs-unit-tests  |     Focuses:
----------------------------------------+----------------------
Changes (by dmsnell):

 * owner:  (none) => dmsnell
 * status:  new => closed
 * resolution:   => fixed


Comment:

 In [changeset:"62433" 62433]:
 {{{
 #!CommitTicketReference repository="" revision="62433"
 KSES: Decode style attribute before sending to safecss_filter_attr().

 `safecss_filter_attr()` assumes that it receives already-unescaped HTML
 attribute values. For example, consider the raw HTML string:

     style="background:url("bg.png")"

 This should be decoded and passed into `safecss_filter_attr()` as:

     background:url("bg.png")

 Unfortuantely this hasn’t been done in `wp_kses_attr_check()`, which
 takes the output from `wp_kses_hair()` and sends it directly to the
 filtering function.

 In this patch, `wp_kses_attr_check()` unescapes the `style` attribute,
 filters it, and then re-escapes it when updating the style value.

 Tests added by Codex

 Developed in: https://github.com/WordPress/wordpress-develop/pull/11868
 Discussed in: https://core.trac.wordpress.org/ticket/65270

 Props dmsnell, westonruter.
 Fixes #65270.
 }}}

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65270#comment:11>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform