easy_svg_pro_dangerous_tags

Filter · Easy SVG Pro · Status: Stable

The Configurator lets an administrator allow extra SVG elements that the sanitizer would normally remove. Some elements are never allowed there, because they can run code or pull in other documents. This filter lets you add more names to that refused list, for example to make sure nobody on a client site can allow image.

Usage

apply_filters( 'easy_svg_pro_dangerous_tags', string[] $tags )

Applied in includes/configurator/configurator.php, inside dangerous_tags(). The result is cast to an array, every name is cast to a string and lower-cased, and the list is merged with the built-in names.

When to use it

• You manage client sites and want a stricter policy than the default, for example no image, use or a elements, whatever an administrator types into the Configurator.
• Your security review flagged an element and you want to revoke it everywhere at once, including on sites where it was already allowed.

Do not use it when:

• You want to allow one of the built-in names. That is not possible through this filter (see Pitfalls).
• You want to change what the sanitizer allows in general. That is the free plugin's esw_svg_allowed_tags.

Parameters

Return value

Default

The built-in list above, unchanged.

Examples

Refuse embedded images on client sites

/**
 * An <image> can load a remote file. Our clients never need it.
 */
function acme_dangerous_tags( $tags ) {
	$tags[] = 'image';
	$tags[] = 'feimage';

	return $tags;
}
add_filter( 'easy_svg_pro_dangerous_tags', 'acme_dangerous_tags' );

feImage is written in lower case because every name is compared in lower case.

A central policy from a must-use plugin

/**
 * mu-plugins/acme-svg-policy.php, deployed to every client site.
 */
function acme_svg_policy_tags( $tags ) {
	return array_merge( (array) $tags, array( 'image', 'use', 'a', 'switch' ) );
}
add_filter( 'easy_svg_pro_dangerous_tags', 'acme_svg_policy_tags' );

See what is refused right now

wp eval 'print_r( apply_filters( "easy_svg_pro_dangerous_tags", array() ) );'

This prints only your additions. The full list is the built-in names plus these.

How it works

The Configurator stores its extra names in the option easy_svg_pro_settings (keys extra_tags and extra_attrs) and only applies them while its switch tags_enabled is on. It needs an active licence, but no feature flag.

The refused list is read at three moments:

1. When the settings are stored through POST /easy-svg-pro/v1/settings. A refused name is dropped and returned in rejected.extra_tags with the reason dangerous. A name with characters outside a-z 0-9 : _ - comes back with the reason invalid.
2. Whenever the settings are read, because pro_settings() cleans the stored option again on every read.
3. Whenever the free sanitizer asks for its allow-list (esw_svg_allowed_tags), because the extra names are checked once more before they are added.

For each name both the full name and the part after the last colon are checked, so s:script is refused like script. Any name that starts with on is refused as well.

So adding a name here takes effect on the next request, also on sites where that name was saved earlier: it is no longer added to the allow-list, and the Configurator stops showing it.

Pitfalls

• Removing a name has no effect. array_diff() or returning an empty array changes nothing, because the built-in names are merged back in.
• The Configurator does not tell you why a stored name disappeared. After you add a name here, an administrator who allowed it earlier just sees it gone from the field.
• Only the Configurator is affected. Names added through the free plugin's esw_svg_allowed_tags filter by other code are not checked against this list.
• Uploads already cleaned stay as they are. The new policy applies to files sanitized from now on. Use the SVG cleaner to re-check existing files.

Related

• easy_svg_pro_dangerous_attrs
• GET|POST easy-svg-pro/v1/settings
• Option: easy_svg_pro_settings