[wp-trac] [WordPress Trac] #48608: SVG tags with numbers in attributes filtered out by KSES despite being allowed

WordPress Trac noreply at wordpress.org
Wed Nov 13 17:16:09 UTC 2019


#48608: SVG tags with numbers in attributes filtered out by KSES despite being
allowed
--------------------------+-----------------------------
 Reporter:  johnpgreen    |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  General       |    Version:
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 I have been able to successfully extend `$allowedposttags` using the
 `wp_kses_allowed_html` filter to allow a limited set of SVG tags but have
 encountered issues when attempting to use the `<linearGradient>` SVG
 element. This element is unique among the elements I have added in that it
 has attributes - specifically `x1`, `x2`, `y1`, and `y2` - that contain
 numbers.

 I believe I have narrowed down the culprit to the `wp_kses_hair` function,
 specifically that case 0 seems to only allow alpha characters.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/48608>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform


More information about the wp-trac mailing list