fix: strip tags from chart custom CSS at render time

[lucadobrescu]

Chart authors control the customcss chart setting, and its contents were concatenated into a <style> block echoed without escaping on every page that renders chart CSS — including the admin Chart Library that aggregates CSS from all charts. This strips tags from each generated rule block at the single point where the CSS is built.

What changed

• CSS builder — get_inline_custom_css() now passes each chart's generated rule block through wp_strip_all_tags(). Before: a customcss value containing </style><script>…</script> broke out of the style element and executed for anyone viewing WP Admin → Visualizer → Chart Library (admins) or a frontend page embedding the chart (visitors). After: markup is removed, legitimate declarations pass through untouched.

• Coverage — fixing at the builder covers all four sinks at once: Chart Library, chart editor data page, chart iframe render, and the frontend render.

Note

wp_strip_all_tags() removes anything tag-shaped, so CSS values can no longer contain literal tag-like strings (e.g. in content:) — these never occur in the plugin's custom-CSS fields. Pure CSS-level injection (e.g. url() references) is out of scope; this closes the script-injection vector.

QA

1. Plant a payload on any published chart (UI save flows strip tags, so use wp-cli):

wp eval 'update_post_meta( <CHART_ID>, "visualizer-settings", array( "customcss" => array( "title" => array( "color" => "red</style><script>alert(1)</script><style>", "font-size" => "12px" ) ) ) );'

2. WP Admin → Visualizer → Chart Library.

Expect: no alert fires. In DevTools, the chart's <style id="customcss-visualizer-<CHART_ID>"> block contains only CSS declarations (font-size: 12px !important; is still present).

3. Regression — open a chart that uses legitimate custom CSS in WP Admin → Visualizer → Chart Library → edit chart, and on a frontend page containing its shortcode.

Expect: custom styles still apply in both places.

[pirate-bot]

Plugin build for dce188c is ready 🛎️!

• Download build

[Copilot]

Pull request overview

Sanitizes chart custom CSS during rendering to prevent stored XSS across all CSS output paths.

Changes:

• Strips HTML tags from generated custom CSS rules.
• Adds an authenticated E2E helper for planting payloads.
• Tests sanitization and legitimate CSS preservation.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
classes/Visualizer/Module.php	Sanitizes generated CSS rules.
tests/e2e/specs/custom-css.spec.js	Verifies XSS prevention and CSS preservation.
tests/e2e/config/plant-chart-settings.php	Adds the test-data REST helper.
.wp-env.json	Loads the E2E helper as an MU plugin.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[lucadobrescu]

The failing E2E test (lazy-render.spec.js › chart renders without artificial script delay) is unrelated to this PR — it fails identically on development itself (run 30446049333: 1 failed / 47 passed) and passes on #1353 and #1354 with these changes applied. All specs added by this stack pass.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.