Commit 03ab969415 for wordpress.org

commit 03ab969415cb3df9d4adc50aae836ca25ed6149c
Author: wildworks <wildworks@git.wordpress.org>
Date:   Tue Oct 27 11:10:52 2026 +0000

    Icons: Skip sanitizing the icons bundled with WordPress

    Icons that ship with WordPress in the core icon library are no longer sanitized when they are loaded, because they are reviewed and versioned like the rest of core. This cuts the server time it takes to render the admin bar and admin menu icons on every admin screen. Icons registered by plugins and themes are still sanitized.

    Developed in: https://github.com/WordPress/wordpress-develop/pull/14492

    Props fushar, softglaze, wildworks.
    Fixes #66338.
    Built from https://develop.svn.wordpress.org/trunk@64800


    git-svn-id: http://core.svn.wordpress.org/trunk@63950 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/class-wp-icons-registry.php b/wp-includes/class-wp-icons-registry.php
index 2a109fb641..1140d0784a 100644
--- a/wp-includes/class-wp-icons-registry.php
+++ b/wp-includes/class-wp-icons-registry.php
@@ -20,6 +20,14 @@ class WP_Icons_Registry {
 	 */
 	protected $registered_icons = array();

+	/**
+	 * Resolved path of the core icon library directory.
+	 *
+	 * @since 7.2.0
+	 * @var string|false|null
+	 */
+	private $core_icon_library_directory = null;
+
 	/**
 	 * Container for the main instance of the class.
 	 *
@@ -367,6 +375,7 @@ class WP_Icons_Registry {
 	 * Retrieves the content of a registered icon.
 	 *
 	 * @since 7.0.0
+	 * @since 7.2.0 Core icons skip sanitization.
 	 *
 	 * @param string $icon_name Icon name including namespace.
 	 * @return string|null The content of the icon, if found.
@@ -390,7 +399,12 @@ class WP_Icons_Registry {
 				return null;
 			}

-			$content = $this->sanitize_icon_content( file_get_contents( $icon_path ) );
+			$content = file_get_contents( $icon_path );
+
+			// Core icons are trusted, so skip the costly sanitization.
+			if ( ! $this->is_core_icon_file( $icon_path ) ) {
+				$content = $this->sanitize_icon_content( $content );
+			}

 			if ( empty( $content ) ) {
 				wp_trigger_error(
@@ -405,6 +419,22 @@ class WP_Icons_Registry {
 		return $this->registered_icons[ $icon_name ]['content'];
 	}

+	/**
+	 * Determines whether an icon file is a core icon.
+	 *
+	 * @since 7.2.0
+	 *
+	 * @param string $icon_path Icon file path, resolved with `realpath()`.
+	 * @return bool Whether the file is in the core icon library.
+	 */
+	private function is_core_icon_file( $icon_path ) {
+		if ( null === $this->core_icon_library_directory ) {
+			$this->core_icon_library_directory = realpath( ABSPATH . WPINC . '/images/icon-library' );
+		}
+
+		return is_string( $this->core_icon_library_directory ) && str_starts_with( $icon_path, $this->core_icon_library_directory . DIRECTORY_SEPARATOR );
+	}
+
 	/**
 	 * Retrieves an array containing the properties of a registered icon.
 	 *
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 22e4f1c630..71cb781a75 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta1-64799';
+$wp_version = '7.2-beta1-64800';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.