[], 'class' => [], 'id' => [], ]; /** * A handful of tags only ever carry class/id (no inline style usage in the * generated markup) — kept distinct from GLOBAL_ATTRS rather than adding an * unused 'style' key to their allowlist. */ private const CLASS_ID_ATTRS = [ 'class' => [], 'id' => [], ]; /** * The client-side validation/conditional-rules data-* attributes shared verbatim * between , and <select> (ACPTFormValidator.js reads these off all * three tag types identically). * * Deliberately NOT added to the repeater/flexible containers (<ul>, <tbody>), which * carry only the data-conditional-rules-* subset: they are not form controls, so * ACPTFormValidator's setCustomValidity() call would throw on them. */ private const DATA_VALIDATION_ATTRS = [ 'data-target-id' => [], 'data-conditional-rules-id' => [], 'data-conditional-rules-field-forged-by' => [], 'data-conditional-rules-field-index' => [], 'data-conditional-rules-block-index' => [], 'data-conditional-rules-block-name' => [], 'data-acpt-validate' => [], 'data-acpt-validate-blank' => [], 'data-acpt-validate-blank-message' => [], 'data-acpt-validate-not-blank' => [], 'data-acpt-validate-not-blank-message' => [], 'data-acpt-validate-equals' => [], 'data-acpt-validate-equals-message' => [], 'data-acpt-validate-not-equals' => [], 'data-acpt-validate-not-equals-message' => [], 'data-acpt-validate-gt' => [], 'data-acpt-validate-gt-message' => [], 'data-acpt-validate-gte' => [], 'data-acpt-validate-gte-message' => [], 'data-acpt-validate-lt' => [], 'data-acpt-validate-lt-message' => [], 'data-acpt-validate-lte' => [], 'data-acpt-validate-lte-message' => [], 'data-acpt-validate-minlength' => [], 'data-acpt-validate-minlength-message' => [], 'data-acpt-validate-min' => [], 'data-acpt-validate-min-message' => [], 'data-acpt-validate-maxlength' => [], 'data-acpt-validate-maxlength-message' => [], 'data-acpt-validate-max' => [], 'data-acpt-validate-max-message' => [], 'data-acpt-validate-required' => [], 'data-acpt-validate-required-message' => [], 'data-acpt-validate-regex' => [], 'data-acpt-validate-regex-message' => [], ]; /** * @see https://www.w3schools.com/tags/ */ public const ALLOWED_FORMATS = [ 'a' => [ 'xlink' => [], 'target' => [], 'class' => [], 'id' => [], 'rel' => [], 'href' => [], 'title' => [], 'style' => [], 'data-block-list-id' => [], 'data-cache' => [], 'data-accepts' => [], 'data-max-size' => [], 'data-min-size' => [], 'data-min-width' => [], 'data-max-width' => [], 'data-min-height' => [], 'data-max-height' => [], 'data-min-blocks' => [], 'data-max-blocks' => [], 'data-add-label' => [], 'data-delete-label' => [], 'data-leading-field' => [], 'data-parent-id' => [], 'data-layout' => [], 'data-index' => [], 'data-id-strategy' => [], 'data-group-id' => [], 'data-target-id' => [], 'data-media-type' => [], 'data-parent-index' => [], 'data-parent-name' => [], 'data-element' => [], 'data-elements' => [], 'data-block-id' => [], 'data-row-id' => [], 'data-col-id' => [], 'aria-label' => [], ], 'abbr' => self::GLOBAL_ATTRS, 'acronym' => [], 'address' => self::GLOBAL_ATTRS, 'applet' => [], 'area' => [], 'article' => self::GLOBAL_ATTRS, 'aside' => self::GLOBAL_ATTRS, 'audio' => [ 'controls' => [], 'src' => [], 'style' => [], 'data-id' => [], 'data-artist' => [], 'data-album' => [], 'data-title' => [], 'class' => [], 'id' => [], ], 'b' => self::GLOBAL_ATTRS, 'base' => [], 'basefont' => [], 'pecifies' => [], 'bdi' => [], 'bdo' => [], 'big' => self::GLOBAL_ATTRS, 'blockquote' => self::GLOBAL_ATTRS, 'body' => self::GLOBAL_ATTRS, 'br' => self::GLOBAL_ATTRS, 'button' => [ 'disabled' => [], 'value' => [], 'rel' => [], 'data-wp-editor-id' => [], 'data-editor' => [], 'data-id' => [], 'data-layout' => [], 'data-index' => [], 'data-multiple' => [], 'data-accepts' => [], 'data-max-size' => [], 'data-min-size' => [], 'data-min-width' => [], 'data-max-width' => [], 'data-min-height' => [], 'data-max-height' => [], 'data-media-type' => [], 'data-parent-index' => [], 'data-target-id' => [], 'data-entity-id' => [], 'data-entity-value' => [], 'data-entity-type' => [], 'data-field-id' => [], 'data-cache' => [], 'data-min-blocks' => [], 'data-max-blocks' => [], 'data-add-label' => [], 'data-delete-label' => [], 'data-leading-field' => [], 'data-hide-label' => [], 'data-label-name' => [], 'readonly' => [], 'style' => [], 'multiple' => [], 'type' => [], 'name' => [], 'class' => [], 'id' => [], 'aria-label' => [], ], 'canvas' => [], 'caption' => [], 'center' => [], 'circle' => [ 'cx' => [], 'cy' => [], 'stroke' => [], 'stroke-dasharray' => [], 'stroke-dashoffset' => [], 'stroke-linecap' => [], 'stroke-linejoin' => [], 'stroke-miterlimit' => [], 'stroke-opacity' => [], 'stroke-width' => [], 'r' => [], 'fill' => [], ], 'cite' => self::GLOBAL_ATTRS, 'code' => self::GLOBAL_ATTRS, 'col' => self::GLOBAL_ATTRS, 'colgroup' => self::GLOBAL_ATTRS, 'data' => [], 'datalist' => self::CLASS_ID_ATTRS, 'dd' => self::GLOBAL_ATTRS, 'del' => self::GLOBAL_ATTRS, 'details' => [], 'dfn' => [], 'dialog' => self::GLOBAL_ATTRS, 'dir' => [], 'efines' => [], 'div' => [ 'data-tabs' => [], 'data-default-values' => [], 'data-field-type' => [], 'data-post-type' => [], 'data-post-status' => [], 'data-post-taxonomy' => [], 'data-term-taxonomy' => [], 'data-user-role' => [], 'data-to-type' => [], 'data-to-value' => [], 'data-default-percent' => [], 'data-restrict-logged-user-posts' => [], 'data-lat' => [], 'data-lng' => [], 'data-prefix' => [], 'data-value' => [], 'data-max' => [], 'data-min' => [], 'data-target' => [], 'data-target-copy' => [], 'data-parent-id' => [], 'data-target-id' => [], 'data-index' => [], 'data-layout' => [], 'data-id' => [], 'data-conditional-rules-box-id' => [], 'style' => [], 'class' => [], 'id' => [], 'draggable' => [], 'aria-hidden' => [], 'aria-label' => [], 'role' => [], 'tabindex' => [], ], 'dl' => self::GLOBAL_ATTRS, 'dt' => self::GLOBAL_ATTRS, 'ellipse' => [ 'cx' => [], 'cy' => [], 'rx' => [], 'ry' => [], 'stroke' => [], 'stroke-dasharray' => [], 'stroke-dashoffset' => [], 'stroke-linecap' => [], 'stroke-linejoin' => [], 'stroke-miterlimit' => [], 'stroke-opacity' => [], 'stroke-width' => [], 'transform' => [], 'fill' => [], ], 'em' => self::GLOBAL_ATTRS, 'embed' => self::GLOBAL_ATTRS, 'fieldset' => self::CLASS_ID_ATTRS, 'figcaption' => self::GLOBAL_ATTRS, 'figure' => self::GLOBAL_ATTRS, 'font' => self::GLOBAL_ATTRS, 'footer' => self::GLOBAL_ATTRS, 'form' => [ 'action' => [], 'method' => [], 'enctype' => [], 'style' => [], 'class' => [], 'id' => [], ], 'frame' => self::GLOBAL_ATTRS, 'frameset' => [], 'g' => [ 'transform' => [], 'fill' => [], 'stroke' => [], 'stroke-dasharray' => [], 'stroke-dashoffset' => [], 'stroke-linecap' => [], 'stroke-linejoin' => [], 'stroke-miterlimit' => [], 'stroke-opacity' => [], 'stroke-width' => [], 'color' => [], 'class' => [], 'id' => [], 'style' => [], ], 'h1' => self::GLOBAL_ATTRS, 'h2' => self::GLOBAL_ATTRS, 'h3' => self::GLOBAL_ATTRS, 'h4' => self::GLOBAL_ATTRS, 'h5' => self::GLOBAL_ATTRS, 'h6' => self::GLOBAL_ATTRS, 'head' => [], 'header' => self::GLOBAL_ATTRS, 'hgroup' => self::GLOBAL_ATTRS, 'hr' => self::GLOBAL_ATTRS, 'html' => self::GLOBAL_ATTRS, 'i' => self::GLOBAL_ATTRS, 'iframe' => [ 'title' => [], 'width' => [], 'height' => [], 'src' => [], 'frameborder' => [], 'allow' => [], 'allowfullscreen' => [], ], 'img' => [ 'class' => [], 'id' => [], 'src' => [], 'alt' => [], 'title' => [], 'data-id' => [], ], 'input' => self::DATA_VALIDATION_ATTRS + [ 'autocomplete' => [], 'accept' => [], 'list' => [], 'disabled' => [], 'onchange' => [], 'onfocus' => [], 'data-format' => [], 'data-min-date' => [], 'data-max-date' => [], 'data-index' => [], 'checked' => [], 'required' => [], 'novalidate' => [], 'aria-required' => [], 'aria-label' => [], 'aria-hidden' => [], 'tabindex' => [], 'value' => [], 'readonly' => [], 'style' => [], 'type' => [], 'name' => [], 'class' => [], 'id' => [], 'minlength' => [], 'maxlength' => [], 'min' => [], 'max' => [], 'step' => [], 'pattern' => [], 'placeholder' => [], ], 'ins' => [], 'kbd' => [], 'label' => [ 'for' => [], 'title' => [], 'style' => [], 'type' => [], 'name' => [], 'class' => [], 'id' => [], 'data-label' => [], 'aria-label' => [], ], 'legend' => self::CLASS_ID_ATTRS, 'li' => [ 'aria-grabbed' => [], 'role' => [], 'style' => [], 'class' => [], 'id' => [], 'draggable' => [], 'data-layout' => [], 'data-value' => [], 'data-cache' => [], 'data-min-blocks' => [], 'data-max-blocks' => [], 'data-add-label' => [], 'data-delete-label' => [], 'data-leading-field' => [], 'data-field-id' => [], 'data-block-list-id' => [], 'data-block-index' => [], 'data-parent-name' => [], 'data-media-type' => [], ], 'line' => [ 'fill' => [], 'x1' => [], 'x2' => [], 'y1' => [], 'y2' => [], 'stroke' => [], 'stroke-dasharray' => [], 'stroke-dashoffset' => [], 'stroke-linecap' => [], 'stroke-linejoin' => [], 'stroke-miterlimit' => [], 'stroke-opacity' => [], 'stroke-width' => [], 'color' => [], 'class' => [], 'id' => [], 'style' => [], ], 'polyline' => [ 'points' => [], 'fill' => [], 'stroke' => [], 'stroke-linecap' => [], 'stroke-linejoin' => [], 'stroke-width' => [], ], 'link' => [], 'main' => self::GLOBAL_ATTRS, 'map' => [], 'mark' => self::GLOBAL_ATTRS, 'menu' => [], 'meta' => [], 'meter' => [], 'nav' => self::GLOBAL_ATTRS, 'noframes' => [], 'noscript' => [], 'object' => self::GLOBAL_ATTRS, 'ol' => self::GLOBAL_ATTRS, 'optgroup' => [ 'label' => [], ], 'option' => [ 'selected' => [], 'value' => [], 'label' => [], 'data-image' => [], 'data-symbol' => [], 'data-placeholder' => [], ], 'output' => [], 'p' => [ 'title' => [], 'style' => [], 'class' => [], 'id' => [], 'data-message-id' => [], ], 'param' => [], 'path' => [ 'd' => [], 'fill' => [], 'style' => [], 'class' => [], 'id' => [], 'name' => [], 'opacity' => [], 'stroke' => [], 'stroke-dasharray' => [], 'stroke-dashoffset' => [], 'stroke-linecap' => [], 'stroke-linejoin' => [], 'stroke-miterlimit' => [], 'stroke-opacity' => [], 'stroke-width' => [], 'fill-rule' => [], 'clip-rule' => [], ], 'picture' => self::GLOBAL_ATTRS, 'pre' => self::GLOBAL_ATTRS, 'progress' => self::GLOBAL_ATTRS, 'q' => self::GLOBAL_ATTRS, 'rect' => [ 'x' => [], 'y' => [], 'rx' => [], 'ry' => [], 'width' => [], 'height' => [], 'stroke' => [], 'stroke-dasharray' => [], 'stroke-dashoffset' => [], 'stroke-linecap' => [], 'stroke-linejoin' => [], 'stroke-miterlimit' => [], 'stroke-opacity' => [], 'stroke-width' => [], 'fill' => [], 'style' => [], 'class' => [], 'id' => [], ], 'rp' => self::GLOBAL_ATTRS, 'rt' => self::GLOBAL_ATTRS, 'ruby' => self::GLOBAL_ATTRS, 's' => self::GLOBAL_ATTRS, 'samp' => self::GLOBAL_ATTRS, // 'script' deliberately absent — wp_kses drops any tag not present here, and admitting // <script> (even attribute-restricted) would let it survive escapeField() for every one // of the 53 Meta field types that flow through this same allowlist. The one legitimate // internal <script type="text/x-template"> usage (RepeaterField's cache template) is // appended after escapeField() runs instead of relying on this allowlist — see // RepeaterField::render(). 'search' => self::GLOBAL_ATTRS, 'section' => self::GLOBAL_ATTRS, // DATA_VALIDATION_ATTRS is unioned in because SelectField, SelectMultiField and // PostField's non-relation layout all emit appendDataValidateAndLogicAttributes() // onto a <select>. Without it wp_kses() stripped every data-acpt-validate* // attribute here, so admin select fields got no client-side validation at all -- // and data-conditional-rules-field-forged-by was dropped too, breaking the // forged-by wiring ACPTConditionalRules.js reads back off the same element. 'select' => self::DATA_VALIDATION_ATTRS + [ 'data-min' => [], 'data-max' => [], 'data-field-type' => [], 'data-default-values' => [], 'data-layout="' => [], 'data-to-type' => [], 'data-to-value' => [], 'data-post-type' => [], 'data-post-status' => [], 'data-post-taxonomy' => [], 'data-term-taxonomy' => [], 'data-user-role' => [], 'data-restrict-logged-user-posts' => [], 'required' => [], 'readonly' => [], 'style' => [], 'multiple' => [], 'type' => [], 'name' => [], 'class' => [], 'id' => [], 'aria-label' => [], ], 'small' => self::GLOBAL_ATTRS, 'source' => [ 'media' => [], 'srcset' => [], 'src' => [], 'type' => [], ], 'span' => [ 'title' => [], 'style' => [], 'class' => [], 'id' => [], 'aria-live' => [], 'role' => [], 'tabindex' => [], 'data-conditional-rules-box-id' => [], ], 'strike' => self::GLOBAL_ATTRS, 'strong' => self::GLOBAL_ATTRS, 'style' => self::GLOBAL_ATTRS, 'sub' => self::GLOBAL_ATTRS, 'summary' => self::GLOBAL_ATTRS, 'sup' => self::GLOBAL_ATTRS, 'svg' => [ 'id' => [], 'fill' => [], 'x' => [], 'y' => [], 'style' => [], 'stroke' => [], 'stroke-dasharray' => [], 'stroke-dashoffset' => [], 'stroke-linecap' => [], 'stroke-linejoin' => [], 'stroke-miterlimit' => [], 'stroke-opacity' => [], 'stroke-width' => [], 'xmlns' => [], 'version' => [], 'xmlns:svg' => [], 'xml:space' => [], 'enable-background' => [], 'aria-hidden' => [], 'role' => [], 'class' => [], 'width' => [], 'height' => [], 'preserveAspectRatio' => [], 'viewbox' => [], 'data-width' => [], 'data-height' => [], 'data-icon' => [], 'clip-rule' => [], ], 'table' => [ 'data-cache' => [], 'data-min-blocks' => [], 'data-max-blocks' => [], 'style' => [], 'class' => [], 'id' => [], ], 'tbody' => [ 'data-cache' => [], 'data-min-blocks' => [], 'data-max-blocks' => [], 'data-conditional-rules-id' => [], 'data-conditional-rules-field-index' => [], 'data-conditional-rules-block-index' => [], 'data-conditional-rules-block-name' => [], 'style' => [], 'class' => [], 'id' => [], ], 'td' => [ 'data-row-id' => [], 'data-col-id' => [], 'spellcheck' => [], 'contenteditable' => [], 'colspan' => [], 'width' => [], 'style' => [], 'class' => [], 'id' => [], ], 'template' => self::GLOBAL_ATTRS, 'text' => [ 'x' => [], 'y' => [], 'style' => [], 'class' => [], 'id' => [], 'text-anchor' => [], ], 'textarea' => self::DATA_VALIDATION_ATTRS + [ 'data-media' => [], 'data-toolbar' => [], 'contentEditable' => [], 'aria-label' => [], 'required' => [], 'minlength' => [], 'maxlength' => [], 'rows' => [], 'cols' => [], 'readonly' => [], 'style' => [], 'multiple' => [], 'type' => [], 'name' => [], 'class' => [], 'id' => [], ], 'tfoot' => self::GLOBAL_ATTRS, 'th' => [ 'data-row-id' => [], 'data-col-id' => [], 'spellcheck' => [], 'contenteditable' => [], 'width' => [], 'style' => [], 'class' => [], 'id' => [], ], 'thead' => self::GLOBAL_ATTRS, 'time' => self::GLOBAL_ATTRS, 'title' => self::GLOBAL_ATTRS, 'tr' => self::GLOBAL_ATTRS, 'track' => self::GLOBAL_ATTRS, 'tt' => self::GLOBAL_ATTRS, 'u' => self::GLOBAL_ATTRS, 'ul' => [ 'style' => [], 'class' => [], 'id' => [], 'data-conditional-rules-id' => [], 'data-cache' => [], 'data-min-blocks' => [], 'data-max-blocks' => [], ], 'var' => [], 'video' => [ 'controls' => [], 'width' => [], 'height' => [], 'muted' => [], ], 'wbr' => self::GLOBAL_ATTRS, ]; }