Repository navigation

KSES: Parse declarations in safecss_filter_attr() - #14784

Draft

sirreal wants to merge 149 commits into

WordPress:trunkfrom

sirreal:css-api/safecss-filter-attr

Draft

KSES: Parse declarations in safecss_filter_attr()#14784
sirreal wants to merge 149 commits into
WordPress:trunkfrom
sirreal:css-api/safecss-filter-attr

Commits on Oct 8, 2026
- CSS API: Add CSS token processor foundations
  sirreal
  committed
  a491bef
- Harden CSS builder identifier serialization
  sirreal
  committed
  a80bd98
- Harden CSS token value updates
  sirreal
  committed
  db896db
- Point CSS API tests at Trac #65738 and set @since 7.2.0
  sirreal
  committed
  b2e6400
- Move string and ident serialization onto the token processor
  sirreal
  committed
  6804231
- Drop the token mutation API
  sirreal
  committed
  c64ca47
- Drop untested token value getters
  sirreal
  committed
  59eece4
- Document corpus provenance
  sirreal
  committed
  52576f1
- Report whether a token ended at its delimiter
  sirreal
  committed
  a9d4b5d
Commits on Oct 9, 2026
- Accept NUL in an unquoted url
  sirreal
  committed
  051e8f5
- Scan plain ASCII runs in idents and urls with strspn
  sirreal
  committed
  27f45f1
- Decode token text with a static method
  sirreal
  committed
  dabd8c5
- Add WP_CSS_Token and WP_CSS_Token_Processor::get_token()
  sirreal
  committed
  2dcba33
- Move string and ident serialization into WP_CSS_Token_Serializer
  sirreal
  committed
  892cd25
- Serialize tokens following CSS Syntax 3 §9
  sirreal
  committed
  8dbd398
- Document why comment tokens are kept
  sirreal
  committed
  3458860
- Escape CR and FF in strings instead of normalizing them
  sirreal
  committed
  47206d9
- Do not spell CDO or CDC from other tokens when serializing
  sirreal
  committed
  2626801
- Make the token serializer internal
  sirreal
  committed
  08f3485
- Build identifier escaping on name escaping
  sirreal
  committed
  c177694
- Fill serializer test gaps
  sirreal
  committed
  06c6e5d
Commits on Oct 13, 2026
- Escape control characters in strings
  sirreal
  committed
  74f3310
- Write hex escapes in lowercase
  sirreal
  committed
  52216bc
- Escape code points outside the non-ASCII ident code points
  sirreal
  committed
  5d86e10
- Add HTML style attribute processor
  sirreal
  committed
  d9a0181
- Harden style attribute parsing
  sirreal
  committed
  787ce33
- Refresh style declarations after mutation
  sirreal
  committed
  a91b7e4
- Respect comments when appending style declarations
  sirreal
  committed
  02ccb51
- Preserve comments when removing style declarations
  sirreal
  committed
  c5e8fcd
- Lazily parse style attribute declarations
  sirreal
  committed
  36da63a
- Document style attribute processor contract
  sirreal
  committed
  b7c0f68
- Clarify style processor factory contract
  sirreal
  committed
  9ebe88d
- Implement style attribute processor contract
  sirreal
  committed
  46ca9fa
- Pin style processor mutation sequencing
  sirreal
  committed
  d321977
- Reject declarations CSS drops at parse time
  sirreal
  committed
  4cbb630
- Set style attribute processor @since to 7.2.0
  sirreal
  committed
  2625c51
- Expose declaration values as a token view
  sirreal
  committed
  00f4b82
- Include the dimension unit in the value token view
  sirreal
  committed
  cf1b73c
- Trim declaration values by token, not by byte
  sirreal
  committed
  a2ea2a4
- Store WP_CSS_Token objects for the style attribute
  sirreal
  committed
  02465b5
- Read token termination for the EOF repair
  sirreal
  committed
  b8bbf3a
- Add serialize_declaration() to the style attribute processor
  sirreal
  committed
  e87aecf
- Document the cost of remove_declaration()
  sirreal
  committed
  9907e3f
- Write set_value() and append_declaration() from tokens
  sirreal
  committed
  190cd2e
- Close strings and comments left open before an append
  sirreal
  committed
  755bff5
Commits on Oct 14, 2026
- Compare style attributes by their declarations in build_visual_html_tree()
  sirreal
  committed
  8f9a71e
- Add assertEqualStyleAttribute()
  sirreal
  committed
  977555c
- Prototype a parser-based style attribute filter
  sirreal
  committed
  5cad306
- Add legacy versus prototype style filter differential
  sirreal
  committed
  5733c37
- Specify the declaration list filter
  sirreal
  committed
  6de460c
- Move the declaration list filter into kses.php
  sirreal
  committed
  044b61f
- Reject bare parenthesis blocks and unterminated strings
  sirreal
  committed
  4c401ab
- Test the declaration list filter
  sirreal
  committed
  e92ebaa
- Update kses tests for the parser-based filter
  sirreal
  committed
  fd95114
- Compare legacy and parser-based filters through the opt-in filter
  sirreal
  committed
  48b1867
- Settle the declaration list filter spec
  sirreal
  committed
  8b466fd
- Reject declarations with unclosed blocks
  sirreal
  committed
  a5b4bcf
- Adapt core callers to the declaration list filter output
  sirreal
  committed
  803f7e9
- Update the declaration list filter spec
  sirreal
  committed
  c34bb04
- Reject delimiters with HTML meaning
  sirreal
  committed
  0d57067
- Drop the last declaration when the input ends inside a token
  sirreal
  committed
  bee5865
- Serialize tokens with decoded values
  sirreal
  committed
  9dc289b
- Deprecate the safecss_filter_attr_allow_css hook
  sirreal
  committed
  aa6ef6d
- Return the input unchanged when the allowed list is empty
  sirreal
  committed
  49b6c94
- Match allowed property names case-insensitively
  sirreal
  committed
  0c166ad
- Reject a lone block in a standard property
  sirreal
  committed
  335de8e
- List the review fixes among the spec differences
  sirreal
  committed
  c91c770
- Rename the legacy CSS filter opt-in to wp_kses_force_legacy_css_parser
  sirreal
  committed
  c239538
- Name no replacement for the deprecated allow_css hook
  sirreal
  committed
  6edf08c
- Allow the filter functions
  sirreal
  committed
  8d6bd3a
- Allow the math functions
  sirreal
  committed
  7b12447
- Allow the easing functions
  sirreal
  committed
  c7f9754
- Reject the src() function
  sirreal
  committed
  a52bbef
- Document the function admission rule
  sirreal
  committed
  71aefe0
- Reject only the ampersand delimiter
  sirreal
  committed
  5e90e87
- Write accepted declarations with serialize_declaration()
  sirreal
  committed
  c153faa
- Close tokens cut off by the end of the input
  sirreal
  committed
  19ea123
- Close blocks left open at the end of the input
  sirreal
  committed
  139a581
- Keep the legacy CSS filter in WP_Theme_JSON
  sirreal
  committed
  54dbfef
- Describe the ampersand rule in the declarations docblock
  sirreal
  committed
  70f2d80
- Use the default list when safe_style_css returns a non-array
  sirreal
  committed
  e31491e
- Ignore safe_style_css entries that are not strings
  sirreal
  committed
  e234fe7
- Reject control character delimiters
  sirreal
  committed
  cf8e902
- Reject backslash delimiters
  sirreal
  committed
  a13bee8
- Join accepted declarations with a space
  sirreal
  committed
  01b992d
Commits on Oct 23, 2026
Commits on Oct 27, 2026
Commits on Oct 28, 2026
Commits on Oct 29, 2026

Commits

Commits on Oct 8, 2026

Commits on Oct 9, 2026

Commits on Oct 13, 2026

Commits on Oct 14, 2026

Commits on Oct 23, 2026

Commits on Oct 27, 2026

Commits on Oct 28, 2026

Commits on Oct 29, 2026