← All changes | core/utils/svg/svg-sanitizer.php +78 -225 4.3.0 → 3.22.2 View file →

		@@ -119,9 +119,8 @@
119	119	/**
120	120	* Is Encoded
121	121	*
122	122	* Check if the contents of the SVG file are gzipped
123		- *
124	123	* @see http://www.gzip.org/zlib/rfc-gzip.html#member-format
125	124	*
126	125	* @since 3.16.0
127	126	* @access private
		@@ -263,213 +262,96 @@
263	262	* @return array
264	263	*/
265	264	private function get_allowed_attributes() {
266	265	$allowed_attributes = [
267		- 'accent-height',
268		- 'accumulate',
269		- 'additive',
270		- 'alignment-baseline',
271		- 'aria-hidden',
272		- 'aria-controls',
273		- 'aria-describedby',
274		- 'aria-description',
275		- 'aria-expanded',
276		- 'aria-haspopup',
277		- 'aria-label',
278		- 'aria-labelledby',
279		- 'aria-roledescription',
280		- 'ascent',
281		- 'attributename',
282		- 'attributetype',
283		- 'azimuth',
284		- 'basefrequency',
285		- 'baseline-shift',
286		- 'begin',
287		- 'bias',
288		- 'by',
289	266	'class',
290		- 'clip',
291	267	'clip-path',
292	268	'clip-rule',
293		- 'clippathunits',
294		- 'color',
295		- 'color-interpolation',
296		- 'color-interpolation-filters',
297		- 'color-profile',
298		- 'color-rendering',
299		- 'cx',
300		- 'cy',
301		- 'd',
302		- 'dx',
303		- 'dy',
304		- 'diffuseconstant',
305		- 'direction',
306		- 'display',
307		- 'divisor',
308		- 'dominant-baseline',
309		- 'dur',
310		- 'edgemode',
311		- 'elevation',
312		- 'end',
313	269	'fill',
314	270	'fill-opacity',
315	271	'fill-rule',
316	272	'filter',
	273	+ 'id',
	274	+ 'mask',
	275	+ 'opacity',
	276	+ 'stroke',
	277	+ 'stroke-dasharray',
	278	+ 'stroke-dashoffset',
	279	+ 'stroke-linecap',
	280	+ 'stroke-linejoin',
	281	+ 'stroke-miterlimit',
	282	+ 'stroke-opacity',
	283	+ 'stroke-width',
	284	+ 'style',
	285	+ 'systemlanguage',
	286	+ 'transform',
	287	+ 'href',
	288	+ 'xlink:href',
	289	+ 'xlink:title',
	290	+ 'cx',
	291	+ 'cy',
	292	+ 'r',
	293	+ 'requiredfeatures',
	294	+ 'clippathunits',
	295	+ 'type',
	296	+ 'rx',
	297	+ 'ry',
	298	+ 'color-interpolation-filters',
	299	+ 'stddeviation',
317	300	'filterres',
318	301	'filterunits',
319		- 'flood-color',
320		- 'flood-opacity',
	302	+ 'height',
	303	+ 'primitiveunits',
	304	+ 'width',
	305	+ 'x',
	306	+ 'y',
	307	+ 'font-size',
	308	+ 'display',
321	309	'font-family',
322		- 'font-size',
323		- 'font-size-adjust',
324		- 'font-stretch',
325	310	'font-style',
326		- 'font-variant',
327	311	'font-weight',
328		- 'fx',
329		- 'fy',
330		- 'g1',
331		- 'g2',
332		- 'glyph-name',
333		- 'glyphref',
334		- 'gradienttransform',
335		- 'gradientunits',
336		- 'height',
337		- 'href',
338		- 'id',
339		- 'image-rendering',
340		- 'in',
341		- 'in2',
342		- 'k',
343		- 'k1',
344		- 'k2',
345		- 'k3',
346		- 'k4',
347		- 'kerning',
348		- 'keypoints',
349		- 'keysplines',
350		- 'keytimes',
351		- 'lang',
352		- 'lengthadjust',
353		- 'letter-spacing',
354		- 'kernelmatrix',
355		- 'kernelunitlength',
356		- 'lighting-color',
357		- 'local',
	312	+ 'text-anchor',
358	313	'marker-end',
359	314	'marker-mid',
360	315	'marker-start',
	316	+ 'x1',
	317	+ 'x2',
	318	+ 'y1',
	319	+ 'y2',
	320	+ 'gradienttransform',
	321	+ 'gradientunits',
	322	+ 'spreadmethod',
361	323	'markerheight',
362	324	'markerunits',
363	325	'markerwidth',
364		- 'mask',
	326	+ 'orient',
	327	+ 'preserveaspectratio',
	328	+ 'refx',
	329	+ 'refy',
	330	+ 'viewbox',
365	331	'maskcontentunits',
366	332	'maskunits',
367		- 'max',
368		- 'media',
369		- 'method',
370		- 'mode',
371		- 'min',
372		- 'name',
373		- 'numoctaves',
374		- 'offset',
375		- 'opacity',
376		- 'operator',
377		- 'order',
378		- 'orient',
379		- 'orientation',
380		- 'origin',
381		- 'overflow',
382		- 'paint-order',
383		- 'path',
384		- 'pathlength',
	333	+ 'd',
385	334	'patterncontentunits',
386	335	'patterntransform',
387	336	'patternunits',
388	337	'points',
389		- 'preservealpha',
390		- 'preserveaspectratio',
391		- 'primitiveunits',
392		- 'r',
393		- 'rx',
394		- 'ry',
395		- 'radius',
396		- 'refx',
397		- 'refy',
398		- 'repeatcount',
399		- 'repeatdur',
400		- 'requiredfeatures',
401		- 'restart',
402		- 'result',
403		- 'role',
404		- 'rotate',
405		- 'scale',
406		- 'seed',
407		- 'shape-rendering',
408		- 'spacing',
409		- 'specularconstant',
410		- 'specularexponent',
411		- 'spreadmethod',
412		- 'startoffset',
413		- 'stddeviation',
414		- 'stitchtiles',
	338	+ 'fx',
	339	+ 'fy',
	340	+ 'offset',
415	341	'stop-color',
416	342	'stop-opacity',
417		- 'stroke',
418		- 'stroke-dasharray',
419		- 'stroke-dashoffset',
420		- 'stroke-linecap',
421		- 'stroke-linejoin',
422		- 'stroke-miterlimit',
423		- 'stroke-opacity',
424		- 'stroke-width',
425		- 'style',
426		- 'surfacescale',
427		- 'systemlanguage',
428		- 'tabindex',
429		- 'targetx',
430		- 'targety',
431		- 'transform',
432		- 'transform-origin',
433		- 'text-anchor',
434		- 'text-decoration',
435		- 'text-rendering',
436		- 'textlength',
437		- 'type',
438		- 'u1',
439		- 'u2',
440		- 'underline-position',
441		- 'underline-thickness',
442		- 'unicode',
443		- 'unicode-bidi',
444		- 'values',
445		- 'vector-effect',
446		- 'vert-adv-y',
447		- 'vert-origin-x',
448		- 'vert-origin-y',
449		- 'viewbox',
450		- 'visibility',
451		- 'width',
452		- 'word-spacing',
453		- 'wrap',
454		- 'writing-mode',
455		- 'x',
456		- 'x1',
457		- 'x2',
458		- 'xchannelselector',
459		- 'xlink:href',
460		- 'xlink:title',
461	343	'xmlns',
462	344	'xmlns:se',
463	345	'xmlns:xlink',
464		- 'xml:lang',
465	346	'xml:space',
466		- 'y',
467		- 'y1',
468		- 'y2',
469		- 'ychannelselector',
470		- 'z',
471		- 'zoomandpan',
	347	+ 'method',
	348	+ 'spacing',
	349	+ 'startoffset',
	350	+ 'dx',
	351	+ 'dy',
	352	+ 'rotate',
	353	+ 'textlength',
472	354	];
473	355
474	356	/**
475	357	* Allowed attributes in SVG file.
		@@ -501,41 +383,15 @@
501	383	*/
502	384	private function get_allowed_elements() {
503	385	$allowed_elements = [
504	386	'a',
505		- 'animate',
506		- 'animateMotion',
507		- 'animateTransform',
508	387	'circle',
509	388	'clippath',
510	389	'defs',
	390	+ 'style',
511	391	'desc',
512	392	'ellipse',
513		- 'feBlend',
514		- 'feColorMatrix',
515		- 'feComponentTransfer',
516		- 'feComposite',
517		- 'feConvolveMatrix',
518		- 'feDiffuseLighting',
519		- 'feDisplacementMap',
520		- 'feDistantLight',
521		- 'feDropShadow',
522		- 'feFlood',
523		- 'feFuncA',
524		- 'feFuncB',
525		- 'feFuncG',
526		- 'feFuncR',
527		- 'feGaussianBlur',
528		- 'feImage',
529		- 'feMerge',
530		- 'feMergeNode',
531		- 'feMorphology',
532		- 'feOffset',
533		- 'fePointLight',
534		- 'feSpecularLighting',
535		- 'feSpotLight',
536		- 'feTile',
537		- 'feTurbulence',
	393	+ 'fegaussianblur',
538	394	'filter',
539	395	'foreignobject',
540	396	'g',
541	397	'image',
		@@ -543,9 +399,8 @@
543	399	'lineargradient',
544	400	'marker',
545	401	'mask',
546	402	'metadata',
547		- 'mpath',
548	403	'path',
549	404	'pattern',
550	405	'polygon',
551	406	'polyline',
		@@ -550,11 +405,9 @@
550	405	'polygon',
551	406	'polyline',
552	407	'radialgradient',
553	408	'rect',
554		- 'set',
555	409	'stop',
556		- 'style',
557	410	'svg',
558	411	'switch',
559	412	'symbol',
560	413	'text',
		@@ -561,9 +414,8 @@
561	414	'textpath',
562	415	'title',
563	416	'tspan',
564	417	'use',
565		- 'view',
566	418	];
567	419
568	420	/**
569	421	* Allowed elements in SVG file.
		@@ -710,8 +562,9 @@
710	562	* Strip Doctype
711	563	*
712	564	* @since 3.16.0
713	565	* @access private
	566	+ *
714	567	*/
715	568	private function strip_doctype() {
716	569	foreach ( $this->svg_dom->childNodes as $child ) {
717	570	if ( XML_DOCUMENT_TYPE_NODE === $child->nodeType ) { // phpcs:ignore -- php DomDocument
		@@ -740,9 +593,9 @@
740	593	if ( ! $this->is_allowed_tag( $current_element ) ) {
741	594	continue;
742	595	}
743	596
744		- // validate element attributes
	597	+ //validate element attributes
745	598	$this->validate_allowed_attributes( $current_element );
746	599
747	600	$this->strip_xlinks( $current_element );
748	601
		@@ -757,21 +610,21 @@
757	610	*
758	611	* @since 3.16.0
759	612	* @access private
760	613	*
761		- * @param string $content
	614	+ * @param $string
762	615	* @return string
763	616	*/
764		- private function strip_php_tags( $content ) {
765		- $content = preg_replace( '/<\?(=|php)(.+?)\?>/i', '', $content );
	617	+ private function strip_php_tags( $string ) {
	618	+ $string = preg_replace( '/<\?(=|php)(.+?)\?>/i', '', $string );
766	619	// Remove XML, ASP, etc.
767		- $content = preg_replace( '/<\?(.*)\?>/Us', '', $content );
768		- $content = preg_replace( '/<\%(.*)\%>/Us', '', $content );
	620	+ $string = preg_replace( '/<\?(.*)\?>/Us', '', $string );
	621	+ $string = preg_replace( '/<\%(.*)\%>/Us', '', $string );
769	622
770		- if ( ( false !== strpos( $content, '<?' ) ) || ( false !== strpos( $content, '<%' ) ) ) {
	623	+ if ( ( false !== strpos( $string, '<?' ) ) || ( false !== strpos( $string, '<%' ) ) ) {
771	624	return '';
772	625	}
773		- return $content;
	626	+ return $string;
774	627	}
775	628
776	629	/**
777	630	* Strip Comments
		@@ -778,19 +631,19 @@
778	631	*
779	632	* @since 3.16.0
780	633	* @access private
781	634	*
782		- * @param string $content
	635	+ * @param $string
783	636	* @return string
784	637	*/
785		- private function strip_comments( $content ) {
	638	+ private function strip_comments( $string ) {
786	639	// Remove comments.
787		- $content = preg_replace( '/<!--(.*)-->/Us', '', $content );
788		- $content = preg_replace( '/\/\*(.*)\*\//Us', '', $content );
789		- if ( ( false !== strpos( $content, '<!--' ) ) || ( false !== strpos( $content, '/*' ) ) ) {
	640	+ $string = preg_replace( '/<!--(.*)-->/Us', '', $string );
	641	+ $string = preg_replace( '/\/\*(.*)\*\//Us', '', $string );
	642	+ if ( ( false !== strpos( $string, '<!--' ) ) || ( false !== strpos( $string, '/*' ) ) ) {
790	643	return '';
791	644	}
792		- return $content;
	645	+ return $string;
793	646	}
794	647
795	648	/**
796	649	* Strip Line Breaks
		@@ -797,12 +650,12 @@
797	650	*
798	651	* @since 3.16.0
799	652	* @access private
800	653	*
801		- * @param string $content
	654	+ * @param $string
802	655	* @return string
803	656	*/
804		- private function strip_line_breaks( $content ) {
	657	+ private function strip_line_breaks( $string ) {
805	658	// Remove line breaks.
806		- return preg_replace( '/\r|\n/', '', $content );
	659	+ return preg_replace( '/\r|\n/', '', $string );
807	660	}
808	661	}