wordpress/wp-includes/customize/class-wp-customize-custom-css-setting.php

<?php
/**
 * Customize API: WP_Customize_Custom_CSS_Setting class
 *
 * This handles validation, sanitization and saving of the value.
 *
 * @package WordPress
 * @subpackage Customize
 * @since 4.7.0
 */

/**
 * Custom Setting to handle WP Custom CSS.
 *
 * @since 4.7.0
 *
 * @see WP_Customize_Setting
 */
final class WP_Customize_Custom_CSS_Setting extends WP_Customize_Setting {

	/**
	 * The setting type.
	 *
	 * @since 4.7.0
	 * @var string
	 */
	public $type = 'custom_css';

	/**
	 * Setting Transport
	 *
	 * @since 4.7.0
	 * @var string
	 */
	public $transport = 'postMessage';

	/**
	 * Capability required to edit this setting.
	 *
	 * @since 4.7.0
	 * @var string
	 */
	public $capability = 'edit_css';

	/**
	 * Stylesheet
	 *
	 * @since 4.7.0
	 * @var string
	 */
	public $stylesheet = '';

	/**
	 * WP_Customize_Custom_CSS_Setting constructor.
	 *
	 * @since 4.7.0
	 *
	 * @throws Exception If the setting ID does not match the pattern `custom_css[$stylesheet]`.
	 *
	 * @param WP_Customize_Manager $manager Customizer bootstrap instance.
	 * @param string               $id      A specific ID of the setting.
	 *                                      Can be a theme mod or option name.
	 * @param array                $args    Setting arguments.
	 */
	public function __construct( $manager, $id, $args = array() ) {
		parent::__construct( $manager, $id, $args );
		if ( 'custom_css' !== $this->id_data['base'] ) {
			throw new Exception( 'Expected custom_css id_base.' );
		}
		if ( 1 !== count( $this->id_data['keys'] ) || empty( $this->id_data['keys'][0] ) ) {
			throw new Exception( 'Expected single stylesheet key.' );
		}
		$this->stylesheet = $this->id_data['keys'][0];
	}

	/**
	 * Add filter to preview post value.
	 *
	 * @since 4.7.9
	 *
	 * @return bool False when preview short-circuits due no change needing to be previewed.
	 */
	public function preview() {
		if ( $this->is_previewed ) {
			return false;
		}
		$this->is_previewed = true;
		add_filter( 'wp_get_custom_css', array( $this, 'filter_previewed_wp_get_custom_css' ), 9, 2 );
		return true;
	}

	/**
	 * Filters `wp_get_custom_css` for applying the customized value.
	 *
	 * This is used in the preview when `wp_get_custom_css()` is called for rendering the styles.
	 *
	 * @since 4.7.0
	 *
	 * @see wp_get_custom_css()
	 *
	 * @param string $css        Original CSS.
	 * @param string $stylesheet Current stylesheet.
	 * @return string CSS.
	 */
	public function filter_previewed_wp_get_custom_css( $css, $stylesheet ) {
		if ( $stylesheet === $this->stylesheet ) {
			$customized_value = $this->post_value( null );
			if ( ! is_null( $customized_value ) ) {
				$css = $customized_value;
			}
		}
		return $css;
	}

	/**
	 * Fetch the value of the setting. Will return the previewed value when `preview()` is called.
	 *
	 * @since 4.7.0
	 *
	 * @see WP_Customize_Setting::value()
	 *
	 * @return string
	 */
	public function value() {
		if ( $this->is_previewed ) {
			$post_value = $this->post_value( null );
			if ( null !== $post_value ) {
				return $post_value;
			}
		}
		$id_base = $this->id_data['base'];
		$value   = '';
		$post    = wp_get_custom_css_post( $this->stylesheet );
		if ( $post ) {
			$value = $post->post_content;
		}
		if ( empty( $value ) ) {
			$value = $this->default;
		}

		/** This filter is documented in wp-includes/class-wp-customize-setting.php */
		$value = apply_filters( "customize_value_{$id_base}", $value, $this );

		return $value;
	}

	/**
	 * Validate a received value for being valid CSS.
	 *
	 * Checks for imbalanced braces, brackets, and comments.
	 * Notifications are rendered when the customizer state is saved.
	 *
	 * @since 4.7.0
	 * @since 4.9.0 Checking for balanced characters has been moved client-side via linting in code editor.
	 * @since 5.9.0 Renamed `$css` to `$value` for PHP 8 named parameter support.
	 * @since 7.0.0 Only restricts contents which risk prematurely closing the STYLE element,
	 *              either through a STYLE end tag or a prefix of one which might become a
	 *              full end tag when combined with the contents of other styles.
	 *
	 * @see WP_REST_Global_Styles_Controller::validate_custom_css()
	 *
	 * @param string $value CSS to validate.
	 * @return true|WP_Error True if the input was validated, otherwise WP_Error.
	 */
	public function validate( $value ) {
		// Restores the more descriptive, specific name for use within this method.
		$css = $value;

		$validity = new WP_Error();

		$length = strlen( $css );
		for (
			$at = strcspn( $css, '<' );
			$at < $length;
			$at += strcspn( $css, '<', ++$at )
		) {
			$remaining_strlen = $length - $at;
			/**
			 * Custom CSS text is expected to render inside an HTML STYLE element.
			 * A STYLE closing tag must not appear within the CSS text because it
			 * would close the element prematurely.
			 *
			 * The text must also *not* end with a partial closing tag (e.g., `<`,
			 * `</`, … `</style`) because subsequent styles which are concatenated
			 * could complete it, forming a valid `</style>` tag.
			 *
			 * Example:
			 *
			 *     $style_a = 'p { font-weight: bold; </sty';
			 *     $style_b = 'le> gotcha!';
			 *     $combined = "{$style_a}{$style_b}";
			 *
			 *     $style_a = 'p { font-weight: bold; </style';
			 *     $style_b = 'p > b { color: red; }';
			 *     $combined = "{$style_a}\n{$style_b}";
			 *
			 * Note how in the second example, both of the style contents are benign
			 * when analyzed on their own. The first style was likely the result of
			 * improper truncation, while the second is perfectly sound. It was only
			 * through concatenation that these two styles combined to form content
			 * that would have broken out of the containing STYLE element, thus
			 * corrupting the page and potentially introducing security issues.
			 *
			 * @see https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state
			 */
			$possible_style_close_tag = 0 === substr_compare(
				$css,
				'</style',
				$at,
				min( 7, $remaining_strlen ),
				true
			);
			if ( $possible_style_close_tag ) {
				if ( $remaining_strlen < 8 ) {
					$validity->add(
						'illegal_markup',
						sprintf(
							/* translators: %s is the CSS that was provided. */
							__( 'The CSS must not end in "%s".' ),
							esc_html( substr( $css, $at ) )
						)
					);
					break;
				}

				if ( 1 === strspn( $css, " \t\f\r\n/>", $at + 7, 1 ) ) {
					$validity->add(
						'illegal_markup',
						sprintf(
							/* translators: %s is the CSS that was provided. */
							__( 'The CSS must not contain "%s".' ),
							esc_html( substr( $css, $at, 8 ) )
						)
					);
					break;
				}
			}
		}

		if ( ! $validity->has_errors() ) {
			$validity = parent::validate( $css );
		}
		return $validity;
	}

	/**
	 * Store the CSS setting value in the custom_css custom post type for the stylesheet.
	 *
	 * @since 4.7.0
	 * @since 5.9.0 Renamed `$css` to `$value` for PHP 8 named parameter support.
	 *
	 * @param string $value CSS to update.
	 * @return int|false The post ID or false if the value could not be saved.
	 */
	public function update( $value ) {
		// Restores the more descriptive, specific name for use within this method.
		$css = $value;

		if ( empty( $css ) ) {
			$css = '';
		}

		$r = wp_update_custom_css_post(
			$css,
			array(
				'stylesheet' => $this->stylesheet,
			)
		);

		if ( is_wp_error( $r ) ) {
			return false;
		}

		$post_id = $r->ID;

		// Cache post ID in theme mod for performance to avoid additional DB query.
		if ( $this->manager->get_stylesheet() === $this->stylesheet ) {
			set_theme_mod( 'custom_css_post_id', $post_id );
		}

		return $post_id;
	}
}