← All changes | includes/icon-library.php +279 -1 2.8.4 → trunk View file →

		@@ -67,9 +67,9 @@
67	67	// Query svg images from the media library.
68	68	$media_svg_images = $this->query_svg_images();
69	69
70	70	if ( $media_svg_images ) {
71		- $icons = $media_svg_images + $icons;
	71	+ $icons = array_merge( $media_svg_images, $icons );
72	72	}
73	73
74	74	wp_send_json(
75	75	[
		@@ -111,7 +111,285 @@
111	111	}
112	112	}
113	113
114	114	return $media_svgs;
	115	+ }
	116	+
	117	+ /**
	118	+ * Sanitize SVG
	119	+ *
	120	+ * @param string $svg
	121	+ * @return string
	122	+ */
	123	+ public function sanitize_svg( $svg ) {
	124	+ if ( ! is_string( $svg ) ) {
	125	+ return '';
	126	+ }
	127	+
	128	+ if ( ! preg_match( '/^\s*<svg\b/i', $svg ) ) {
	129	+ return '';
	130	+ }
	131	+
	132	+ // Hard block dangerous stuff.
	133	+ if (
	134	+ preg_match(
	135	+ '/<(script|iframe|object|embed|foreignObject|image|feImage|use|animate|set)\b/i',
	136	+ $svg
	137	+ )
	138	+ ) {
	139	+ return '';
	140	+ }
	141	+
	142	+ // Remove null bytes.
	143	+ $svg = wp_kses_no_null( $svg );
	144	+
	145	+ // Remove event handlers.
	146	+ $svg = preg_replace(
	147	+ '/\son[a-z-]+\s*=\s*("|\').*?\1/i',
	148	+ '',
	149	+ $svg
	150	+ );
	151	+
	152	+ // Remove href-like attrs.
	153	+ $svg = preg_replace(
	154	+ '/\s(?:href|xlink:href|src)\s*=\s*("|\').*?\1/i',
	155	+ '',
	156	+ $svg
	157	+ );
	158	+
	159	+ // KSES sanitization.
	160	+ $svg = wp_kses(
	161	+ $svg,
	162	+ $this->get_allowed_svg_tags()
	163	+ );
	164	+
	165	+ return trim( $svg );
	166	+ }
	167	+
	168	+ /**
	169	+ * Get allowed svg tags and attributes
	170	+ *
	171	+ * @return array
	172	+ */
	173	+ private function get_allowed_svg_tags() {
	174	+ $global_attrs = [
	175	+ // Common.
	176	+ 'id' => true,
	177	+ 'class' => true,
	178	+ 'aria-hidden' => true,
	179	+
	180	+ // Presentation.
	181	+ 'clip-path' => true,
	182	+ 'clip-rule' => true,
	183	+ 'color' => true,
	184	+ 'color-interpolation' => true,
	185	+ 'display' => true,
	186	+ 'fill' => true,
	187	+ 'fill-opacity' => true,
	188	+ 'fill-rule' => true,
	189	+ 'mask' => true,
	190	+ 'opacity' => true,
	191	+ 'pointer-events' => true,
	192	+ 'shape-rendering' => true,
	193	+ 'stroke' => true,
	194	+ 'stroke-dasharray' => true,
	195	+ 'stroke-dashoffset' => true,
	196	+ 'stroke-linecap' => true,
	197	+ 'stroke-linejoin' => true,
	198	+ 'stroke-miterlimit' => true,
	199	+ 'stroke-opacity' => true,
	200	+ 'stroke-width' => true,
	201	+ 'transform' => true,
	202	+ 'vector-effect' => true,
	203	+ 'visibility' => true,
	204	+ ];
	205	+
	206	+ $allowed_svg = [
	207	+ 'svg' => array_merge(
	208	+ $global_attrs,
	209	+ [
	210	+ 'xmlns' => true,
	211	+ 'viewbox' => true,
	212	+ 'width' => true,
	213	+ 'height' => true,
	214	+ 'x' => true,
	215	+ 'y' => true,
	216	+ 'preserveaspectratio' => true,
	217	+ 'name' => true,
	218	+ 'role' => true,
	219	+ 'focusable' => true,
	220	+ 'aria-labelledby' => true,
	221	+ ]
	222	+ ),
	223	+
	224	+ 'g' => $global_attrs,
	225	+
	226	+ 'defs' => [],
	227	+
	228	+ 'symbol' => [
	229	+ 'id' => true,
	230	+ 'viewbox' => true,
	231	+ ],
	232	+
	233	+ 'title' => [],
	234	+ 'desc' => [],
	235	+
	236	+ 'path' => array_merge(
	237	+ $global_attrs,
	238	+ [
	239	+ 'd' => true,
	240	+ 'pathlength' => true,
	241	+ ]
	242	+ ),
	243	+
	244	+ 'circle' => array_merge(
	245	+ $global_attrs,
	246	+ [
	247	+ 'cx' => true,
	248	+ 'cy' => true,
	249	+ 'r' => true,
	250	+ 'pathlength' => true,
	251	+ ]
	252	+ ),
	253	+
	254	+ 'ellipse' => array_merge(
	255	+ $global_attrs,
	256	+ [
	257	+ 'cx' => true,
	258	+ 'cy' => true,
	259	+ 'rx' => true,
	260	+ 'ry' => true,
	261	+ 'pathlength' => true,
	262	+ ]
	263	+ ),
	264	+
	265	+ 'rect' => array_merge(
	266	+ $global_attrs,
	267	+ [
	268	+ 'x' => true,
	269	+ 'y' => true,
	270	+ 'width' => true,
	271	+ 'height' => true,
	272	+ 'rx' => true,
	273	+ 'ry' => true,
	274	+ 'pathlength' => true,
	275	+ ]
	276	+ ),
	277	+
	278	+ 'line' => array_merge(
	279	+ $global_attrs,
	280	+ [
	281	+ 'x1' => true,
	282	+ 'y1' => true,
	283	+ 'x2' => true,
	284	+ 'y2' => true,
	285	+ 'pathlength' => true,
	286	+ ]
	287	+ ),
	288	+
	289	+ 'polyline' => array_merge(
	290	+ $global_attrs,
	291	+ [
	292	+ 'points' => true,
	293	+ 'pathlength' => true,
	294	+ ]
	295	+ ),
	296	+
	297	+ 'polygon' => array_merge(
	298	+ $global_attrs,
	299	+ [
	300	+ 'points' => true,
	301	+ 'pathlength' => true,
	302	+ ]
	303	+ ),
	304	+
	305	+ 'linearGradient' => [
	306	+ 'id' => true,
	307	+ 'x1' => true,
	308	+ 'y1' => true,
	309	+ 'x2' => true,
	310	+ 'y2' => true,
	311	+ 'gradientunits' => true,
	312	+ 'gradienttransform' => true,
	313	+ 'spreadmethod' => true,
	314	+ ],
	315	+
	316	+ 'radialGradient' => [
	317	+ 'id' => true,
	318	+ 'cx' => true,
	319	+ 'cy' => true,
	320	+ 'r' => true,
	321	+ 'fx' => true,
	322	+ 'fy' => true,
	323	+ 'gradientunits' => true,
	324	+ 'gradienttransform' => true,
	325	+ 'spreadmethod' => true,
	326	+ ],
	327	+
	328	+ 'stop' => [
	329	+ 'offset' => true,
	330	+ 'stop-color' => true,
	331	+ 'stop-opacity' => true,
	332	+ ],
	333	+
	334	+ 'clipPath' => [
	335	+ 'id' => true,
	336	+ 'clippathunits' => true,
	337	+ 'transform' => true,
	338	+ ],
	339	+
	340	+ 'mask' => [
	341	+ 'id' => true,
	342	+ 'x' => true,
	343	+ 'y' => true,
	344	+ 'width' => true,
	345	+ 'height' => true,
	346	+ 'maskunits' => true,
	347	+ 'maskcontentunits' => true,
	348	+ ],
	349	+
	350	+ 'pattern' => [
	351	+ 'id' => true,
	352	+ 'x' => true,
	353	+ 'y' => true,
	354	+ 'width' => true,
	355	+ 'height' => true,
	356	+ 'patternunits' => true,
	357	+ 'patterntransform' => true,
	358	+ 'viewbox' => true,
	359	+ ],
	360	+
	361	+ 'text' => array_merge(
	362	+ $global_attrs,
	363	+ [
	364	+ 'x' => true,
	365	+ 'y' => true,
	366	+ 'dx' => true,
	367	+ 'dy' => true,
	368	+ 'textlength' => true,
	369	+ 'rotate' => true,
	370	+ 'text-anchor' => true,
	371	+ 'font-size' => true,
	372	+ 'font-family' => true,
	373	+ 'font-weight' => true,
	374	+ 'letter-spacing' => true,
	375	+ 'lengthadjust' => true,
	376	+ ]
	377	+ ),
	378	+
	379	+ 'tspan' => [
	380	+ 'x' => true,
	381	+ 'y' => true,
	382	+ 'dx' => true,
	383	+ 'dy' => true,
	384	+ 'text-anchor' => true,
	385	+ 'font-size' => true,
	386	+ 'font-family' => true,
	387	+ 'font-weight' => true,
	388	+ 'letter-spacing' => true,
	389	+ ],
	390	+ ];
	391	+
	392	+ return apply_filters( 'cbb_get_allowed_svg_tags', $allowed_svg );
115	393	}
116	394	}
117	395	endif;