Formatting: match CSS function names case-insensitively in safecss_fi… - #12949
Formatting: match CSS function names case-insensitively in safecss_fi…#12949Anupkankale wants to merge 1 commit into
Conversation
…lter_attr(). CSS function names are ASCII case-insensitive, so `CALC(1px + 2px)`, `URL(foo.jpg)`, and `LINEAR-GRADIENT(red, blue)` are all valid CSS. Every function-matching pattern in `safecss_filter_attr()` was case-sensitive, however, so valid declarations using anything other than all-lowercase function names were silently dropped. Add the `i` modifier to the `url()`, gradient, and generic function patterns, and lowercase the value before the `url(` / `-gradient(` sniffing done for custom properties. Only the function names are matched loosely; the grammar each pattern accepts is unchanged, so a mixed-case value is now held to exactly the same standard as its lowercase equivalent. Protocol checking in `wp_kses_bad_protocol()` was already case-insensitive, so `URL()` values are validated the same way `url()` values are. Property names remain case-sensitive, which is a separate concern. Fixes #65838. See #64974. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Unlinked AccountsThe following contributors have not linked their GitHub and WordPress.org accounts: @your-github-email@gmail.com. Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Trac Ticket MissingThis pull request is missing a link to a Trac ticket. For a contribution to be considered, there must be a corresponding ticket in Trac. To attach a pull request to a Trac ticket, please include the ticket's full URL in your pull request description. More information about contributing to WordPress on GitHub can be found in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
This comment was marked as low quality.
This comment was marked as low quality.
Sorry, something went wrong.
2 participants
CSS function names are ASCII case-insensitive, so
CALC(1px + 2px),URL(foo.jpg), andLINEAR-GRADIENT(red, blue)are all valid CSS. Every function-matching pattern insafecss_filter_attr()was case-sensitive, however, so valid declarations using anything other than all-lowercase function names were silently dropped.Add the
imodifier to theurl(), gradient, and generic function patterns, and lowercase the value before theurl(/-gradient(sniffing done for custom properties.Only the function names are matched loosely; the grammar each pattern accepts is unchanged, so a mixed-case value is now held to exactly the same standard as its lowercase equivalent. Protocol checking in
wp_kses_bad_protocol()was already case-insensitive, soURL()values are validated the same wayurl()values are.Property names remain case-sensitive, which is a separate concern.
Fixes #65838. See #64974.
Trac ticket:
Use of AI Tools
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.