diff --git a/projects/packages/classic-theme-helper/changelog/update-svg-icon-inclusion-method b/projects/packages/classic-theme-helper/changelog/update-svg-icon-inclusion-method new file mode 100644 index 0000000000000..b2021fe32d96d --- /dev/null +++ b/projects/packages/classic-theme-helper/changelog/update-svg-icon-inclusion-method @@ -0,0 +1,4 @@ +Significance: patch +Type: security + +Social Menu: Switch to more appropriate method of calling the SVG icon file. diff --git a/projects/packages/classic-theme-helper/src/social-menu/icon-functions.php b/projects/packages/classic-theme-helper/src/social-menu/icon-functions.php index 2095e44f7448e..527d2443422f2 100644 --- a/projects/packages/classic-theme-helper/src/social-menu/icon-functions.php +++ b/projects/packages/classic-theme-helper/src/social-menu/icon-functions.php @@ -18,7 +18,28 @@ function jetpack_social_menu_include_svg_icons() { $svg_icons = __DIR__ . '/social-menu.svg'; // If it exists and we use the SVG menu type, include it. if ( file_exists( $svg_icons ) && 'svg' === jetpack_social_menu_get_type() ) { - require_once $svg_icons; + $svg_contents = file_get_contents( $svg_icons ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Only reading a local file. + } + + if ( ! empty( $svg_contents ) ) { + $allowed_tags = array( + 'svg' => array( + 'style' => true, + 'version' => true, + 'xmlns' => true, + 'xmlns:xlink' => true, + ), + 'defs' => array(), + 'symbol' => array( + 'id' => true, + 'viewbox' => true, + ), + 'path' => array( + 'd' => true, + 'style' => true, + ), + ); + echo wp_kses( $svg_contents, $allowed_tags ); } } add_action( 'wp_footer', 'jetpack_social_menu_include_svg_icons', 9999 ); diff --git a/projects/plugins/jetpack/changelog/update-svg-icon-inclusion-method b/projects/plugins/jetpack/changelog/update-svg-icon-inclusion-method new file mode 100644 index 0000000000000..f93841e54df16 --- /dev/null +++ b/projects/plugins/jetpack/changelog/update-svg-icon-inclusion-method @@ -0,0 +1,4 @@ +Significance: patch +Type: other + +Social Menus: Switch to more appropriate method of calling the SVG icon file. diff --git a/projects/plugins/jetpack/modules/theme-tools/social-menu/icon-functions.php b/projects/plugins/jetpack/modules/theme-tools/social-menu/icon-functions.php index 9c3d6d0cdc464..56a464d40c2df 100644 --- a/projects/plugins/jetpack/modules/theme-tools/social-menu/icon-functions.php +++ b/projects/plugins/jetpack/modules/theme-tools/social-menu/icon-functions.php @@ -19,7 +19,28 @@ function jetpack_social_menu_include_svg_icons() { $svg_icons = __DIR__ . '/social-menu.svg'; // If it exists and we use the SVG menu type, include it. if ( file_exists( $svg_icons ) && 'svg' === jetpack_social_menu_get_type() ) { - require_once $svg_icons; + $svg_contents = file_get_contents( $svg_icons ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Only reading a local file. + } + + if ( ! empty( $svg_contents ) ) { + $allowed_tags = array( + 'svg' => array( + 'style' => true, + 'version' => true, + 'xmlns' => true, + 'xmlns:xlink' => true, + ), + 'defs' => array(), + 'symbol' => array( + 'id' => true, + 'viewbox' => true, + ), + 'path' => array( + 'd' => true, + 'style' => true, + ), + ); + echo wp_kses( $svg_contents, $allowed_tags ); } } add_action( 'wp_footer', 'jetpack_social_menu_include_svg_icons', 9999 ); diff --git a/projects/plugins/jetpack/modules/widgets/social-icons.php b/projects/plugins/jetpack/modules/widgets/social-icons.php index 940b52e2a71a7..f708c0a0aa714 100644 --- a/projects/plugins/jetpack/modules/widgets/social-icons.php +++ b/projects/plugins/jetpack/modules/widgets/social-icons.php @@ -124,7 +124,28 @@ public function include_svg_icons() { // If it exists, include it. if ( is_file( $svg_icons ) ) { - require_once $svg_icons; + $svg_contents = file_get_contents( $svg_icons ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Only reading a local file. + } + + if ( ! empty( $svg_contents ) ) { + $allowed_tags = array( + 'svg' => array( + 'style' => true, + 'version' => true, + 'xmlns' => true, + 'xmlns:xlink' => true, + ), + 'defs' => array(), + 'symbol' => array( + 'id' => true, + 'viewbox' => true, + ), + 'path' => array( + 'd' => true, + 'style' => true, + ), + ); + echo wp_kses( $svg_contents, $allowed_tags ); } }