Task #2969 - kses: Applying some fixes from WordPress 3.1 (2), adding code for sanitizing inline css definitions.

main/inc/lib/kses-0.2.2/kses.php

@@ -213,6 +213,19 @@ function kses_attr($element, $attr, $allowed_html, $allowed_protocols)
                                  $currkey, $currval))
                 { $ok = false; break; }
 
+            if ( strtolower($arreach['name']) == 'style' ) {
+                $orig_value = $arreach['value'];
+
+                $value = kses_safecss_filter_attr($orig_value);
+
+                if ( empty($value) )
+                    continue;
+
+                $arreach['value'] = $value;
+
+                $arreach['whole'] = str_replace($orig_value, $value, $arreach['whole']);
+            }
+
             if ($ok)
                 $attr2 .= ' '.$arreach['whole']; // it passed them
         } // if !is_array($current)
@@ -645,4 +658,53 @@ function kses_decode_entities($string)
     return $string;
 }
 
-?>
+/**
+ * Inline CSS filter
+ *
+ */
+function kses_safecss_filter_attr( $css ) {
+
+    $css = kses_no_null($css);
+    $css = str_replace(array("\n","\r","\t"), '', $css);
+
+    if ( preg_match( '%[\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
+        return '';
+
+    $css_array = explode( ';', trim( $css ) );
+    $allowed_attr = array( 'text-align', 'margin', 'color', 'float',
+        'border', 'background', 'background-color', 'border-bottom', 'border-bottom-color',
+        'border-bottom-style', 'border-bottom-width', 'border-collapse', 'border-color', 'border-left',
+        'border-left-color', 'border-left-style', 'border-left-width', 'border-right', 'border-right-color',
+        'border-right-style', 'border-right-width', 'border-spacing', 'border-style', 'border-top',
+        'border-top-color', 'border-top-style', 'border-top-width', 'border-width', 'caption-side',
+        'clear', 'cursor', 'direction', 'display', 'font', 'font-family', 'font-size', 'font-style',
+        'font-variant', 'font-weight', 'height', 'letter-spacing', 'line-height', 'margin-bottom',
+        'margin-left', 'margin-right', 'margin-top', 'overflow', 'padding', 'padding-bottom',
+        'padding-left', 'padding-right', 'padding-top', 'text-decoration', 'text-indent', 'vertical-align',
+        'width' );
+
+    if ( empty($allowed_attr) )
+        return $css;
+
+    $css = '';
+    foreach ( $css_array as $css_item ) {
+        if ( $css_item == '' )
+            continue;
+        $css_item = trim( $css_item );
+        $found = false;
+        if ( strpos( $css_item, ':' ) === false ) {
+            $found = true;
+        } else {
+            $parts = split( ':', $css_item );
+            if ( in_array( strtolower( trim( $parts[0] ) ), $allowed_attr ) )
+                $found = true;
+        }
+        if ( $found ) {
+            if( $css != '' )
+                $css .= ';';
+            $css .= $css_item;
+        }
+    }
+
+    return $css;
+}