Eliminate use of safecss_filter_attr() in processing style attributes since redundant and lossy #1004
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #613.
There is a problem with the use of
safecss_filter_attr()
in\AMP_Style_Sanitizer::process_style()
introduced via https://github.com/Automattic/amp-wp/blob/23eced628815e169ca9831b2ccb460b49adc53c1/includes/sanitizers/class-amp-style-sanitizer.php#L456This is what is removing the
display
property. It was introduced in de2a303 with the comment:The logic in
safecss_filter_attr()
is already being run on post save to strip outdisplay
, if the user doesn't haveunfiltered_html
. So this is preventingsafecss_filter_attr()
from being called a second time when displaying the post, resulting in a plugin that outputs a Kses-illegal style property to be also erroneously stripped. Otherwise, if a user does haveunfiltered_html
then they currently aren't able to do so in AMP even in spite of the sanitizer.