Commit 021b79178f for wordpress.org

commit 021b79178fff854057882bdabf129f533c40d873
Author: wildworks <wildworks@git.wordpress.org>
Date:   Thu Sep 17 08:27:47 2026 +0000

    Icons: Allow more SVG elements and attributes in the sanitizer.

    The icon sanitizer in `WP_Icons_Registry` stripped valid SVG markup, so icons using fill rules, clip paths, strokes, or shapes such as `rect` and `circle` did not render correctly. Expand the allow-list for `svg` and `path` to permit that markup, allow the same stroke attributes on `polygon`, and add `rect` and `circle` as newly allowed elements.

    Developed in: https://github.com/WordPress/wordpress-develop/pull/6395

    Follow-up to r62748.

    Props westonruter, wildworks.
    See #65795.

    Built from https://develop.svn.wordpress.org/trunk@63652


    git-svn-id: http://core.svn.wordpress.org/trunk@62826 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/class-wp-icons-registry.php b/wp-includes/class-wp-icons-registry.php
index b40c5ec124..5a0296a920 100644
--- a/wp-includes/class-wp-icons-registry.php
+++ b/wp-includes/class-wp-icons-registry.php
@@ -240,10 +240,19 @@ class WP_Icons_Registry {
 	}

 	/**
-	 * Sanitizes the icon SVG content.
+	 * Builds the allowed attribute list for wp_kses() from attribute names.
+	 *
+	 * @since 7.2.0
 	 *
-	 * Logic borrowed from twentytwenty.
-	 * @see twentytwenty_get_theme_svg
+	 * @param non-falsy-string ...$attribute_names Attribute names to allow.
+	 * @return array<non-falsy-string, true> Attribute names mapped to true.
+	 */
+	private function get_allowed_attribute_list( ...$attribute_names ): array {
+		return array_fill_keys( $attribute_names, true );
+	}
+
+	/**
+	 * Sanitizes the icon SVG content.
 	 *
 	 * @since 7.0.0
 	 *
@@ -251,29 +260,81 @@ class WP_Icons_Registry {
 	 * @return string The sanitized icon SVG content.
 	 */
 	protected function sanitize_icon_content( $icon_content ) {
+		$stroke_attributes = $this->get_allowed_attribute_list(
+			'style',
+			'stroke',
+			'stroke-width',
+			'stroke-linecap',
+			'stroke-linejoin',
+			'stroke-miterlimit',
+			'vector-effect',
+		);
+
 		$allowed_tags = array(
-			'svg'     => array(
-				'class'       => true,
-				'xmlns'       => true,
-				'width'       => true,
-				'height'      => true,
-				'viewbox'     => true,
-				'aria-hidden' => true,
-				'role'        => true,
-				'focusable'   => true,
+			'svg'     => array_merge(
+				$this->get_allowed_attribute_list(
+					'class',
+					'xmlns',
+					'width',
+					'height',
+					'viewbox',
+					'aria-hidden',
+					'role',
+					'focusable',
+					'fill',
+					'fill-rule',
+					'clip-rule',
+				),
+				$stroke_attributes
+			),
+			'path'    => array_merge(
+				$this->get_allowed_attribute_list(
+					'fill',
+					'fill-rule',
+					'clip-rule',
+					'd',
+					'opacity',
+					'transform',
+				),
+				$stroke_attributes
 			),
-			'path'    => array(
-				'fill'      => true,
-				'fill-rule' => true,
-				'd'         => true,
-				'transform' => true,
+			'polygon' => array_merge(
+				$this->get_allowed_attribute_list(
+					'fill',
+					'fill-rule',
+					'clip-rule',
+					'points',
+					'transform',
+					'focusable',
+				),
+				$stroke_attributes
+			),
+			'rect'    => array_merge(
+				$this->get_allowed_attribute_list(
+					'fill',
+					'fill-rule',
+					'clip-rule',
+					'x',
+					'y',
+					'width',
+					'height',
+					'rx',
+					'ry',
+					'transform',
+				),
+				$stroke_attributes
 			),
-			'polygon' => array(
-				'fill'      => true,
-				'fill-rule' => true,
-				'points'    => true,
-				'transform' => true,
-				'focusable' => true,
+			'circle'  => array_merge(
+				$this->get_allowed_attribute_list(
+					'fill',
+					'fill-rule',
+					'clip-rule',
+					'cx',
+					'cy',
+					'r',
+					'transform',
+				),
+				$stroke_attributes
 			),
 		);
 		return wp_kses( $icon_content, $allowed_tags );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 28f0115a9c..cf80b07c9e 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63651';
+$wp_version = '7.2-alpha-63652';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.