easy_svg_pro_dangerous_attrs

Filter · Easy SVG Pro · Status: Stable

Next to extra elements, the Configurator lets an administrator allow extra SVG attributes. href, xlink:href and every event handler such as onload can never be allowed there. This filter adds more attribute names to that refused list.

Usage

apply_filters( 'easy_svg_pro_dangerous_attrs', string[] $attrs )

Applied in includes/configurator/configurator.php, inside dangerous_attrs(). The result is cast to an array, every name is lower-cased, and the list is merged with the built-in names.

When to use it

• You want to stop administrators from allowing attributes that load or point at other resources, such as src, filter or mask on a strict site.
• You want one policy for all client sites, set in a must-use plugin instead of in each Configurator.

Do not use it when:

• You want to block event handlers. Every name starting with on is refused already by a separate rule.
• You want to allow href. That is not possible through this filter.

Parameters

Return value

Default

array( 'href', 'xlink:href' ).

Examples

No filters and masks from the Configurator

function acme_dangerous_attrs( $attrs ) {
	$attrs[] = 'filter';
	$attrs[] = 'mask';

	return $attrs;
}
add_filter( 'easy_svg_pro_dangerous_attrs', 'acme_dangerous_attrs' );

Tags and attributes from one policy array

/**
 * One place for the agency SVG policy.
 */
function acme_svg_policy() {
	return array(
		'tags'  => array( 'image', 'use' ),
		'attrs' => array( 'src', 'filter' ),
	);
}

function acme_policy_tags( $tags ) {
	return array_merge( (array) $tags, acme_svg_policy()['tags'] );
}
add_filter( 'easy_svg_pro_dangerous_tags', 'acme_policy_tags' );

function acme_policy_attrs( $attrs ) {
	return array_merge( (array) $attrs, acme_svg_policy()['attrs'] );
}
add_filter( 'easy_svg_pro_dangerous_attrs', 'acme_policy_attrs' );

What the REST answer looks like

Sending a refused name to the settings route stores the rest and reports the refused one:

curl -X POST https://example.com/wp-json/easy-svg-pro/v1/settings \
  -u admin:"xxxx xxxx xxxx xxxx xxxx xxxx" \
  -H "Content-Type: application/json" \
  -d '{"tags_enabled":true,"extra_attrs":["filter","vector-effect"]}'

{
  "tags_enabled": true,
  "extra_tags": [],
  "extra_attrs": ["vector-effect"],
  "rejected": {
    "extra_tags": [],
    "extra_attrs": [ { "name": "filter", "reason": "dangerous" } ]
  }
}

How it works

The attribute list is read at the same moments as the tag list: when the Configurator settings are stored, every time they are read, and every time the free sanitizer asks for its attribute allow-list (esw_svg_allowed_attributes).

For every name the Configurator checks, in this order:

1. Is it made only of a-z, 0-9, :, _ and -? If not, the reason is invalid.
2. Is the full name, or the part after the last colon, on the refused list? Then dangerous.
3. Does the full name or that last part start with on? Then dangerous too.

A name added through this filter therefore stops working at once, also where it was stored before.

Pitfalls

• Removing href does nothing. It is merged back in.
• on is a prefix rule. A harmless name that happens to start with on cannot be allowed either.
• A namespace prefix does not help. x:href is refused because its last part is href.
• Other code is not checked. Attributes added by another plugin through esw_svg_allowed_attributes do not pass this list.

Related

• easy_svg_pro_dangerous_tags
• GET|POST easy-svg-pro/v1/settings
• Option: easy_svg_pro_settings