Page MenuHomePhabricator

Allow -webkit-filter CSS
Closed, DuplicatePublicFeature

Description

Currently, all uses of -webkit-filter in a tag's style attribute are being replaced with "/* insecure input */". Assuming this is due to confusion with -ms-filter and there isn't any actual security risk in allowing -webkit-filter, the style should be allowed.


Version: 1.19
Severity: enhancement

Details

Reference
bz39662

Event Timeline

bzimport raised the priority of this task from to Low.Nov 22 2014, 1:10 AM
bzimport added a project: MediaWiki-Parser.
bzimport set Reference to bz39662.
bzimport added a subscriber: Unknown Object (MLST).
Aklapper changed the subtype of this task from "Task" to "Feature Request".Feb 4 2022, 11:14 AM
Aklapper removed a subscriber: wikibugs-l-list.
SnorlaxMonster subscribed.

This was resolved by https://phabricator.wikimedia.org/T308160. It is now possible to use -webkit-filter (although the unprefixed filter should be preferred anyway).

T308160: Uncensor use of "filter" CSS property on wikitext pages is about the wikitext parser. This issue is tagged as TemplateStyles (now, at least; presumably the task author meant the task to be about the parser, since it predates the existence of TemplateStyes). In TemplateStyles, this isn't resolved.

I'll just untag and close as duplicate to reduce confusion. Please file a dedicated task for TemplateStyles / css-sanitizer if you think this functionality is needed there.

Ah sorry, that was my tag. I should have tagged it as CSS instead of css-sanitizer.

(FWIW css-sanititer does handle filter already.)