From e3e6d1ec26d45ddaf979c934c00ba4f1ee8610ee Mon Sep 17 00:00:00 2001
From: Aki Hamano <tetsuaki.hamano@gmail.com>
Date: Tue, 15 Sep 2026 22:57:54 +0900
Subject: [PATCH] Icons: Allow rect and circle elements in the icon registry
 sanitizer.

A number of icons in the icon library are redrawn with the `rect` and
`circle` elements. `WP_Icons_Registry::sanitize_icon_content()` allows the
`svg`, `path` and `polygon` tags only, so `wp_kses()` removes both elements
before the icon is stored or returned.

This adds `rect` and `circle` to the allowlist, carrying the same
presentation attributes the existing shapes have along with the geometry
attributes each element needs.

Props wildworks, retrofox.
See #66101.
Fixes #66112.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 src/wp-includes/class-wp-icons-registry.php   | 19 ++++++++
 tests/phpunit/tests/icons/wpIconsRegistry.php | 45 +++++++++++++++++++
 2 files changed, 64 insertions(+)

diff --git a/src/wp-includes/class-wp-icons-registry.php b/src/wp-includes/class-wp-icons-registry.php
index a10960da9a077..bbfa86782f628 100644
--- a/src/wp-includes/class-wp-icons-registry.php
+++ b/src/wp-includes/class-wp-icons-registry.php
@@ -261,6 +261,25 @@ protected function sanitize_icon_content( $icon_content ) {
 				'transform' => true,
 				'focusable' => true,
 			),
+			'rect'    => array(
+				'fill'      => true,
+				'fill-rule' => true,
+				'x'         => true,
+				'y'         => true,
+				'width'     => true,
+				'height'    => true,
+				'rx'        => true,
+				'ry'        => true,
+				'transform' => true,
+			),
+			'circle'  => array(
+				'fill'      => true,
+				'fill-rule' => true,
+				'cx'        => true,
+				'cy'        => true,
+				'r'         => true,
+				'transform' => true,
+			),
 		);
 		return wp_kses( $icon_content, $allowed_tags );
 	}
diff --git a/tests/phpunit/tests/icons/wpIconsRegistry.php b/tests/phpunit/tests/icons/wpIconsRegistry.php
index 42853d2666a95..18e92981f211c 100644
--- a/tests/phpunit/tests/icons/wpIconsRegistry.php
+++ b/tests/phpunit/tests/icons/wpIconsRegistry.php
@@ -453,4 +453,49 @@ public function test_get_content_returns_null_for_invalid_file( $contents, $exte
 
 		$this->assertNull( $icon['content'] );
 	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public function data_register_icon_preserves_rect_and_circle() {
+		return array(
+			'rect'   => array( '<rect fill="currentColor" fill-rule="evenodd" x="4" y="5" width="16" height="14" rx="2" ry="2" transform="rotate(45)" />' ),
+			'circle' => array( '<circle fill="currentColor" fill-rule="evenodd" cx="12" cy="12" r="3" transform="rotate(45)" />' ),
+		);
+	}
+
+	/**
+	 * Should preserve the `rect` and `circle` elements that library icons are drawn with.
+	 *
+	 * @ticket 66112
+	 *
+	 * @dataProvider data_register_icon_preserves_rect_and_circle
+	 *
+	 * @covers ::register
+	 *
+	 * @param string $shape Shape element the icon is drawn with.
+	 */
+	public function test_register_icon_preserves_rect_and_circle( $shape ) {
+		$name = 'test-collection/shape-icon';
+
+		$this->assertTrue(
+			$this->registry->register(
+				$name,
+				array(
+					'label'   => 'Shape Icon',
+					'content' => '<svg viewbox="0 0 24 24">' . $shape . '</svg>',
+				)
+			)
+		);
+
+		$icon = $this->registry->get_registered_icon( $name );
+
+		$this->assertStringContainsString(
+			$shape,
+			$icon['content'],
+			'Attributes were altered or stripped from the shape element.'
+		);
+	}
 }