KSES: Support autofocus for dialog children

[rootzero00]

Trac ticket: https://core.trac.wordpress.org/ticket/65717

Summary

Adds context-aware KSES support for the �utofocus attribute on descendants of dialog elements while preserving existing behavior outside the intended dialog context.

Testing

• PHP lint passes for src/wp-includes/kses.php
• PHP lint passes for ests/phpunit/tests/kses.php
• Targeted PHPUnit: 23 tests, 28 assertions, passing
• Full KSES PHPUnit: 417 tests, 1472 assertions, passing
• WordPress Coding Standards: passing
• git diff --check: passing
• Candidate validated against current trunk with no material intervening overlap found

Use of AI Tools

AI assistance: Yes.

Used for implementation analysis, candidate refinement, validation planning, and test/review assistance. The final implementation and publication candidate were independently validated against the WordPress test and coding-standard toolchain.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props raulsalvat, dmsnell.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[dmsnell]

I’m nowhere smart enough to understand what these are saying, even after re-reading them multiples times.

If pre_kses changed the normalized input, structural identity is no longer established. Preserve the hook mutation but do not broaden contextual autofocus for this invocation.

Reduces the post-context autofocus allowance to actual dialog scope.

@rootzero00 you want to write what you meant in different wording? What were you trying to convey with these comments?

---

I’m going to ask for some delay on this, because in #13271 I’m trying to prep a full refactor of wp_kses() to use the HTML API internally, and the shape of this kind of work will likely be significantly simpler after that refactor. In any case, it will be a growing hassle to be making substantial changes to wp_kses() while that work is in place. My hope is to merge something in next week, so the delay is likely less than the normal review delay would be.

[rootzero00]

Thanks for calling this out, those comments are definitely too abstract. What I was trying to say was: For the first comment, the code saves the normalized content before running `pre_kses`, then compares it with the content returned by the hook. If `pre_kses` changes that content, I don't try to infer the dialog ancestry from the original input anymore. I keep the hook's modified content and fall back to the normal KSES path instead of using the new dialog/autofocus-specific path. So "structural identity is no longer established" was really just meant to say: if the hook changes the HTML, I can no longer assume that the structure I was about to inspect is the same structure that came into the hook. For the second comment, the implementation temporarily allows `autofocus` while processing the post allowlist, but `_wp_kses_sanitize_dialog_autofocus()` then walks the HTML and removes `autofocus` from any element that is not actually inside a `dialog`. So "reduces the post-context autofocus allowance to actual dialog scope" was meant to say: even though `autofocus` is temporarily permitted during KSES processing, it is retained only on elements whose parsed ancestry actually contains a `dialog`. I'll also hold off on further changes here while #13271 is in progress. Once that refactor lands, I'm happy to revisit this against the new `wp_kses()` structure and simplify the approach if appropriate. Thanks for pointing out the wording issue.

…

On Fri, Aug 28, 2026 at 12:40 AM Dennis Snell ***@***.***> wrote: *dmsnell* left a comment (WordPress/wordpress-develop#13298) <#13298 (comment)> I’m nowhere smart enough to understand what these are saying, even after re-reading them multiples times. If pre_kses changed the normalized input, structural identity is no longer established. Preserve the hook mutation but do not broaden contextual autofocus for this invocation. Reduces the post-context autofocus allowance to actual dialog scope. @rootzero00 <https://github.com/rootzero00> you want to write what you meant in different wording? What were you trying to convey with these comments? ------------------------------ I’m going to ask for some delay on this, because in #13271 <#13271> I’m trying to prep a full refactor of wp_kses() to use the HTML API internally, and the shape of this kind of work will likely be significantly simpler after that refactor. In any case, it will be a growing hassle to be making substantial changes to wp_kses() while that work is in place. My hope is to merge something in next week, so the delay is likely less than the normal review delay would be. — Reply to this email directly, view it on GitHub <#13298?email_source=notifications&email_token=CFF4WIS2BYX2IPYDH726FN35MEEKHA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNBUHA2TCMRSGE42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5448512219>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CFF4WIUTQWLAHHELEM6BVVT5MEEKHAVCNFSNUABEKJSXA33TNF2G64TZHM3TKNRUGU3DKOJ3JFZXG5LFHM2TENZRHE4DSMZVGWQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/CFF4WIQPKVCJVKBZ3ADSMGT5MEEKHA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNBUHA2TCMRSGE42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/CFF4WIR65UV5DM7C76F62J35MEEKHA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNBUHA2TCMRSGE42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>