Update kses allowed attributes 2022 #2654
Conversation
* sort modified tag attributes alphabetically (no removals) * add all attributes for <img> tag * allow picture + source tag to allow loading webp,... with fallback * allow select + option tags for dropdowns * allow meta and link tag for improved SEO and performance * allow autocomplete attribute for form Attributes are mostly based on https://developer.mozilla.org/en-US/docs/Web/HTML/Element with some containing browser specifics which were introduced in the last years. The tags were chosen based on a WP installation that contains the most popular WP + WooCommerce plugins, as well as features introduced by browsers (e.g. picture tag)
|
I think the changes here are too broad. https://core.trac.wordpress.org/ticket/55605 is just about the There was https://core.trac.wordpress.org/ticket/53098 for adding basically all HTML tags, like this PR seems to be doing to an extent. There is also a comment there explaining why the list is currently as it is. The intention behind the KSES allowlist is not to 1:1 match all the existing HTML tags there are. It only contains the ones that provide value and address a specific need. Also, many of these attributes need specific sanitization as well. That's why there is a separate ticket for Aside: There are some merge conflicts |
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core SVNCore Committers: Use this line as a base for the props when committing in SVN: GitHub Merge commitsIf you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
|
After re-reading the ticket, I decided to close the ticket as wontfix because |
Trac ticket: https://core.trac.wordpress.org/ticket/55605
Additionally:
Attributes are mostly based on https://developer.mozilla.org/en-US/docs/Web/HTML/Element with some containing browser specifics which were introduced in the last years.
The tags were chosen based on a WP installation that contains the most popular WP + WooCommerce plugins, as well as features introduced by browsers (e.g. picture tag)