Icons: Store the sanitized icon content on registration.

Icons registered with inline SVG content are now stored in their sanitized form, so disallowed markup such as event handler attributes is no longer retained in the registry or returned to consumers.

Developed in: WordPress#12623

Follow-up to [62748].

Props tyxla, wildworks.
See #64847.


git-svn-id: https://develop.svn.wordpress.org/trunk@62811 602fd350-edb4-49c9-b593-d223f7449a82

Author: t-hamano

src/wp-includes/class-wp-icons-registry.php

@@ -170,6 +170,8 @@ public function register( $icon_name, $icon_properties ) {
 				);
 				return false;
 			}
+
+			$icon_properties['content'] = $sanitized_icon_content;
 		}
 
 		$qualified_name = $collection . '/' . $unqualified_name;

tests/phpunit/tests/icons/wpIconsRegistry.php

@@ -258,6 +258,28 @@ public function test_register_icon_with_file_path() {
 		$this->assertStringContainsString( '<svg', $icon['content'] );
 	}
 
+	/**
+	 * Should register an icon with its `content` sanitized.
+	 *
+	 * @ticket 64847
+	 *
+	 * @covers ::register
+	 */
+	public function test_register_icon_sanitizes_content() {
+		$result = $this->registry->register(
+			'test-collection/unsafe-content',
+			array(
+				'label'   => 'Icon',
+				'content' => '<svg viewbox="0 0 24 24" onload="alert(1)"><path d="M0 0" /></svg>',
+			)
+		);
+
+		$this->assertTrue( $result );
+
+		$icon = $this->registry->get_registered_icon( 'test-collection/unsafe-content' );
+		$this->assertSame( '<svg viewbox="0 0 24 24"><path d="M0 0" /></svg>', $icon['content'] );
+	}
+
 	/**
 	 * Should fail to register an icon that provides both `content` and `file_path`.
 	 *