wp_kses: add support for picture element and srcset attribute on img tags

src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -4604,7 +4604,14 @@ public function set_attribute( $name, $value ): bool {
 			 *
 			 * @see https://html.spec.whatwg.org/#attributes-3
 			 */
-			$escaped_new_value = in_array( $comparable_name, wp_kses_uri_attributes(), true )
+			/*
+			 * Multi-URI attributes such as srcset contain a comma-separated list
+			 * of URLs with optional width/density descriptors, not a single URL.
+			 * Passing the whole value through esc_url() would encode the
+			 * descriptor spaces and corrupt the list, so those attributes receive
+			 * the standard attribute escaping instead.
+			 */
+			$escaped_new_value = ! in_array( $comparable_name, wp_kses_multi_uri_attributes(), true ) && in_array( $comparable_name, wp_kses_uri_attributes(), true )
 				? esc_url( $value )
 				: strtr(
 					$value,

src/wp-includes/kses.php

@@ -212,17 +212,21 @@
 		),
 		'i'          => array(),
 		'img'        => array(
-			'alt'      => true,
-			'align'    => true,
-			'border'   => true,
-			'height'   => true,
-			'hspace'   => true,
-			'loading'  => true,
-			'longdesc' => true,
-			'vspace'   => true,
-			'src'      => true,
-			'usemap'   => true,
-			'width'    => true,
+			'align'         => true,
+			'alt'           => true,
+			'border'        => true,
+			'decoding'      => true,
+			'fetchpriority' => true,
+			'height'        => true,
+			'hspace'        => true,
+			'loading'       => true,
+			'longdesc'      => true,
+			'sizes'         => true,
+			'src'           => true,
+			'srcset'        => true,
+			'usemap'        => true,
+			'vspace'        => true,
+			'width'         => true,
 		),
 		'ins'        => array(
 			'datetime' => true,
@@ -273,6 +277,7 @@
 		'p'          => array(
 			'align' => true,
 		),
+		'picture'    => array(),
 		'pre'        => array(
 			'width' => true,
 		),
@@ -298,6 +303,12 @@
 			'align' => true,
 		),
 		'small'      => array(),
+		'source'     => array(
+			'media'  => true,
+			'sizes'  => true,
+			'srcset' => true,
+			'type'   => true,
+		),
 		'strike'     => array(),
 		'strong'     => array(),
 		'sub'        => array(),
@@ -981,7 +992,6 @@ function wp_kses( $content, $allowed_html, $allowed_protocols = array() ) {
  * @return string Filtered attribute.
  */
 function wp_kses_one_attr( $attr, $element ) {
-	$uris              = wp_kses_uri_attributes();
 	$allowed_html      = wp_kses_allowed_html( 'post' );
 	$allowed_protocols = wp_allowed_protocols();
 	$attr              = wp_kses_no_null( $attr, array( 'slash_zero' => 'keep' ) );
@@ -1025,10 +1035,7 @@ function wp_kses_one_attr( $attr, $element ) {
 		// Sanitize quotes, angle braces, and entities.
 		$value = esc_attr( $value );
 
-		// Sanitize URI values.
-		if ( in_array( strtolower( $name ), $uris, true ) ) {
-			$value = wp_kses_bad_protocol( $value, $allowed_protocols );
-		}
+		$value = wp_kses_sanitize_uris( $name, $value, $allowed_protocols );
 
 		$attr  = "$name=$quote$value$quote";
 		$vless = 'n';
@@ -1245,6 +1252,7 @@ function wp_kses_uri_attributes() {
 		'poster',
 		'profile',
 		'src',
+		'srcset',
 		'usemap',
 		'xmlns',
 	);
@@ -1264,6 +1272,42 @@ function wp_kses_uri_attributes() {
 	return $uri_attributes;
 }
 
+/**
+ * Returns an array of HTML attribute names whose value contains a list of URLs.
+ *
+ * Unlike single-URL attributes such as `href` or `src`, these attributes hold a
+ * comma-separated list of URLs, each optionally followed by a descriptor, for
+ * example `srcset="small.jpg 480w, large.jpg 1024w"`. Their values must be split
+ * into individual candidates so each URL can be sanitized on its own, and must
+ * not be passed through `esc_url()` as a whole.
+ *
+ * An attribute in this list is only sanitized as a URI if it is also present
+ * in {@see wp_kses_uri_attributes()}.
+ *
+ * @since 7.1.0
+ *
+ * @return string[] HTML attribute names whose value contains a list of URLs.
+ */
+function wp_kses_multi_uri_attributes() {
+	$multi_uri_attributes = array(
+		'srcset',
+	);
+
+	/**
+	 * Filters the list of attributes whose value contains a list of URLs.
+	 *
+	 * Use this filter to add attributes that, like `srcset`, contain multiple
+	 * comma-separated URLs with optional descriptors. Attributes added here
+	 * must also be added to the `wp_kses_uri_attributes` filter to be
+	 * sanitized as URIs.
+	 *
+	 * @since 7.1.0
+	 *
+	 * @param string[] $multi_uri_attributes HTML attribute names whose value contains a list of URLs.
+	 */
+	return apply_filters( 'wp_kses_multi_uri_attributes', $multi_uri_attributes );
+}
+
 /**
  * Callback for `wp_kses_split()`.
  *
@@ -1624,7 +1668,6 @@ function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowe
  */
 function wp_kses_hair( $attr, $allowed_protocols ) {
 	$attributes = array();
-	$uris       = wp_kses_uri_attributes();
 
 	$processor = new WP_HTML_Tag_Processor( "<wp {$attr}>" );
 	$processor->next_token();
@@ -1645,8 +1688,8 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
 	foreach ( $attribute_names as $name ) {
 		$value   = $processor->get_attribute( $name );
 		$is_bool = true === $value;
-		if ( is_string( $value ) && in_array( $name, $uris, true ) ) {
-			$value = wp_kses_bad_protocol( $value, $allowed_protocols );
+		if ( is_string( $value ) ) {
+			$value = wp_kses_sanitize_uris( $name, $value, $allowed_protocols );
 		}
 
 		// Reconstruct and normalize the attribute value.
@@ -1664,6 +1707,92 @@ function wp_kses_hair( $attr, $allowed_protocols ) {
 	return $attributes;
 }
 
+/**
+ * Sanitizes URI values in HTML attributes.
+ *
+ * This function centralizes logic for cleaning attribute values that are expected to contain URLs.
+ * It checks if the attribute name is one that should contain a URI (e.g., 'href', 'src', 'srcset').
+ * For attributes that can contain multiple URIs (such as 'srcset'), it splits the value and sanitizes each URI individually.
+ * All URI values are passed through {@see wp_kses_bad_protocol()} to remove disallowed protocols (e.g., 'javascript:').
+ *
+ * @since 7.1.0
+ *
+ * @param string        $attr_name         The attribute name to test.
+ * @param string        $attr_value        The attribute value to sanitize.
+ * @param string[]      $allowed_protocols Array of allowed URL protocols.
+ * @param string[]|null $multi_uri_attrs   Optional. Attributes that can contain multiple URIs.
+ *                                         Default null, meaning the {@see wp_kses_multi_uri_attributes()} list.
+ * @return string Sanitized attribute value.
+ */
+function wp_kses_sanitize_uris( string $attr_name, string $attr_value, array $allowed_protocols, ?array $multi_uri_attrs = null ): string {
+	$attr_name = strtolower( $attr_name );
+	$uri_attrs = wp_kses_uri_attributes();
+
+	if ( null === $multi_uri_attrs ) {
+		$multi_uri_attrs = wp_kses_multi_uri_attributes();
+	}
+
+	if ( ! in_array( $attr_name, $uri_attrs, true ) ) {
+		return $attr_value;
+	}
+
+	if ( in_array( $attr_name, $multi_uri_attrs, true ) ) {
+		/*
+		 * Parse srcset-style attributes into entries so each URL can be sanitized individually.
+		 *
+		 * Srcset entries are: URL [descriptor], URL [descriptor], ...
+		 * Descriptors match patterns like "480w", "2x", or "1.5x", and are optional.
+		 *
+		 * A naive split on all commas breaks URLs that contain commas internally
+		 * (e.g. CDN image resizer URLs like cdn-cgi/image/format=auto,quality=80/...).
+		 *
+		 * Instead, treat a comma as an entry separator only when it cannot be part
+		 * of a URL, which is the case when it:
+		 * - follows a width or pixel density descriptor (e.g. "img.jpg 2x, next.jpg"), or
+		 * - is adjacent to whitespace (URLs in srcset must encode whitespace as %20,
+		 *   so a comma next to whitespace always separates two entries).
+		 *
+		 * Known limitation: a comma attached to an *invalid* descriptor (e.g.
+		 * "img.jpg 2q,next.jpg") does not match either rule, so the surrounding
+		 * text is protocol-checked as a single URL. Browsers may parse such an
+		 * invalid srcset into more candidates than KSES does. This asymmetry is
+		 * accepted because srcset candidates are only ever fetched as images;
+		 * a disallowed scheme that rides through this way is never navigated
+		 * to or executed.
+		 */
+		$descriptor     = '\d+(?:\.\d+)?[wx]';
+		$delimiter      = '\s+' . $descriptor . '\s*,\s*|\s*,\s+|\s+,\s*';
+		$delim_pattern  = '/(' . $delimiter . ')/i';
+		$delim_anchored = '/^(?:' . $delimiter . ')$/i';
+		$entry_pattern  = '/^(\s*)(.*?)(\s+' . $descriptor . ')?\s*$/i';
+
+		$parts  = (array) preg_split( $delim_pattern, $attr_value, -1, PREG_SPLIT_DELIM_CAPTURE );
+		$result = '';
+
+		foreach ( $parts as $part ) {
+			if ( preg_match( $delim_anchored, $part ) ) {
+				// This is a delimiter between two entries. Append it as-is to preserve spacing.
+				$result .= $part;
+				continue;
+			}
+
+			// This is a URL (possibly with a trailing descriptor for the last entry).
+			if ( preg_match( $entry_pattern, $part, $matches ) ) {
+				$leading_whitespace  = $matches[1];
+				$url                 = $matches[2];
+				$trailing_descriptor = $matches[3] ?? '';
+				$result             .= $leading_whitespace . wp_kses_bad_protocol( $url, $allowed_protocols ) . $trailing_descriptor;
+			} else {
+				$result .= wp_kses_bad_protocol( $part, $allowed_protocols );
+			}
+		}
+
+		return $result;
+	}
+
+	return wp_kses_bad_protocol( $attr_value, $allowed_protocols );
+}
+
 /**
  * Finds all attributes of an HTML element.
  *

tests/phpunit/tests/html-api/wpHtmlTagProcessor.php

@@ -954,6 +954,82 @@ public static function data_set_attribute_prevents_xss() {
 		);
 	}
 
+	/**
+	 * Ensure that setting a srcset attribute preserves the value as-is.
+	 *
+	 * srcset is a URI attribute per wp_kses_uri_attributes(), but unlike single-URL
+	 * attributes it holds a comma-separated list of URLs with optional descriptors.
+	 * Passing the whole value through esc_url() would encode the descriptor spaces
+	 * as %20 and collapse the list into one broken URL.
+	 *
+	 * @ticket 29807
+	 *
+	 * @covers WP_HTML_Tag_Processor::set_attribute
+	 */
+	public function test_set_attribute_preserves_srcset_value() {
+		$srcset    = 'small.jpg 480w, medium.jpg 800w, large.jpg 2x';
+		$processor = new WP_HTML_Tag_Processor( '<img src="small.jpg">' );
+		$processor->next_tag();
+		$processor->set_attribute( 'srcset', $srcset );
+
+		$this->assertSame(
+			'<img srcset="small.jpg 480w, medium.jpg 800w, large.jpg 2x" src="small.jpg">',
+			$processor->get_updated_html(),
+			'set_attribute() did not preserve the srcset value verbatim'
+		);
+		$this->assertSame(
+			$srcset,
+			$processor->get_attribute( 'srcset' ),
+			'get_attribute() did not return the srcset value set via set_attribute()'
+		);
+	}
+
+	/**
+	 * Ensure that set_attribute() consults wp_kses_multi_uri_attributes() rather
+	 * than hardcoding srcset.
+	 *
+	 * A URI attribute normally passes through esc_url(), which would corrupt a
+	 * srcset-style list by encoding the descriptor spaces. An attribute added to
+	 * both the `wp_kses_uri_attributes` and `wp_kses_multi_uri_attributes`
+	 * filters must skip esc_url() and keep its list value intact.
+	 *
+	 * @ticket 29807
+	 *
+	 * @covers WP_HTML_Tag_Processor::set_attribute
+	 */
+	public function test_set_attribute_respects_multi_uri_attributes_filter() {
+		$srcset_list = 'a.jpg 1x, b.jpg 2x';
+		$add_custom  = static function ( $attrs ) {
+			$attrs[] = 'data-srcset';
+			return $attrs;
+		};
+
+		// Registered only as a URI attribute, the value is passed through esc_url() and corrupted.
+		add_filter( 'wp_kses_uri_attributes', $add_custom );
+		$processor = new WP_HTML_Tag_Processor( '<img src="a.jpg">' );
+		$processor->next_tag();
+		$processor->set_attribute( 'data-srcset', $srcset_list );
+		$this->assertSame(
+			'http://a.jpg%201x,%20b.jpg%202x',
+			$processor->get_attribute( 'data-srcset' ),
+			'A single-URI attribute should receive esc_url() escaping'
+		);
+
+		// Also registered as a multi-URI attribute, the list value is preserved.
+		add_filter( 'wp_kses_multi_uri_attributes', $add_custom );
+		$processor = new WP_HTML_Tag_Processor( '<img src="a.jpg">' );
+		$processor->next_tag();
+		$processor->set_attribute( 'data-srcset', $srcset_list );
+		$this->assertSame(
+			$srcset_list,
+			$processor->get_attribute( 'data-srcset' ),
+			'A multi-URI attribute must not be passed through esc_url()'
+		);
+
+		remove_filter( 'wp_kses_uri_attributes', $add_custom );
+		remove_filter( 'wp_kses_multi_uri_attributes', $add_custom );
+	}
+
 	/**
 	 * @ticket 56299
 	 *