Social Menu: Replacing SVG file inclusion method (#39136)

Automattic · Oct 25, 2024 · f62e42c · f62e42c
1 parent e059266
commit f62e42c
Show file tree

Hide file tree

Showing 5 changed files with 74 additions and 3 deletions.
diff --git a/projects/packages/classic-theme-helper/changelog/update-svg-icon-inclusion-method b/projects/packages/classic-theme-helper/changelog/update-svg-icon-inclusion-method
@@ -0,0 +1,4 @@
+Significance: patch
+Type: security
+
+Social Menu: Switch to more appropriate method of calling the SVG icon file.
diff --git a/projects/packages/classic-theme-helper/src/social-menu/icon-functions.php b/projects/packages/classic-theme-helper/src/social-menu/icon-functions.php
@@ -18,7 +18,28 @@ function jetpack_social_menu_include_svg_icons() {
 		$svg_icons = __DIR__ . '/social-menu.svg';
 		// If it exists and we use the SVG menu type, include it.
 		if ( file_exists( $svg_icons ) && 'svg' === jetpack_social_menu_get_type() ) {
-			require_once $svg_icons;
+			$svg_contents = file_get_contents( $svg_icons ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Only reading a local file.
+		}
+
+		if ( ! empty( $svg_contents ) ) {
+			$allowed_tags = array(
+				'svg'    => array(
+					'style'       => true,
+					'version'     => true,
+					'xmlns'       => true,
+					'xmlns:xlink' => true,
+				),
+				'defs'   => array(),
+				'symbol' => array(
+					'id'      => true,
+					'viewbox' => true,
+				),
+				'path'   => array(
+					'd'     => true,
+					'style' => true,
+				),
+			);
+			echo wp_kses( $svg_contents, $allowed_tags );
 		}
 	}
 	add_action( 'wp_footer', 'jetpack_social_menu_include_svg_icons', 9999 );

diff --git a/projects/plugins/jetpack/changelog/update-svg-icon-inclusion-method b/projects/plugins/jetpack/changelog/update-svg-icon-inclusion-method
@@ -0,0 +1,4 @@
+Significance: patch
+Type: other
+
+Social Menus: Switch to more appropriate method of calling the SVG icon file.
diff --git a/projects/plugins/jetpack/modules/theme-tools/social-menu/icon-functions.php b/projects/plugins/jetpack/modules/theme-tools/social-menu/icon-functions.php
@@ -19,7 +19,28 @@ function jetpack_social_menu_include_svg_icons() {
 		$svg_icons = __DIR__ . '/social-menu.svg';
 		// If it exists and we use the SVG menu type, include it.
 		if ( file_exists( $svg_icons ) && 'svg' === jetpack_social_menu_get_type() ) {
-			require_once $svg_icons;
+			$svg_contents = file_get_contents( $svg_icons ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Only reading a local file.
+		}
+
+		if ( ! empty( $svg_contents ) ) {
+			$allowed_tags = array(
+				'svg'    => array(
+					'style'       => true,
+					'version'     => true,
+					'xmlns'       => true,
+					'xmlns:xlink' => true,
+				),
+				'defs'   => array(),
+				'symbol' => array(
+					'id'      => true,
+					'viewbox' => true,
+				),
+				'path'   => array(
+					'd'     => true,
+					'style' => true,
+				),
+			);
+			echo wp_kses( $svg_contents, $allowed_tags );
 		}
 	}
 	add_action( 'wp_footer', 'jetpack_social_menu_include_svg_icons', 9999 );

diff --git a/projects/plugins/jetpack/modules/widgets/social-icons.php b/projects/plugins/jetpack/modules/widgets/social-icons.php
@@ -124,7 +124,28 @@ public function include_svg_icons() {
 
 		// If it exists, include it.
 		if ( is_file( $svg_icons ) ) {
-			require_once $svg_icons;
+			$svg_contents = file_get_contents( $svg_icons ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Only reading a local file.
+		}
+
+		if ( ! empty( $svg_contents ) ) {
+			$allowed_tags = array(
+				'svg'    => array(
+					'style'       => true,
+					'version'     => true,
+					'xmlns'       => true,
+					'xmlns:xlink' => true,
+				),
+				'defs'   => array(),
+				'symbol' => array(
+					'id'      => true,
+					'viewbox' => true,
+				),
+				'path'   => array(
+					'd'     => true,
+					'style' => true,
+				),
+			);
+			echo wp_kses( $svg_contents, $allowed_tags );
 		}
 	}