WP_Theme_JSON::remove_insecure_properties( array $theme_json, string $origin = 'theme' ): array

4656	public static function remove_insecure_properties( $theme_json, $origin = 'theme' ) {4657		if ( ! in_array( $origin, static::VALID_ORIGINS, true ) ) {4658			$origin = 'theme';4659		}4660 4661		$sanitized = array();4662 4663		$theme_json = WP_Theme_JSON_Schema::migrate( $theme_json, $origin );4664 4665		$blocks_metadata     = static::get_blocks_metadata();4666		$valid_block_names   = array_keys( $blocks_metadata );4667		$valid_element_names = array_keys( static::ELEMENTS );4668		$valid_variations    = static::get_valid_block_style_variations( $blocks_metadata );4669 4670		$theme_json = static::sanitize( $theme_json, $valid_block_names, $valid_element_names, $valid_variations );4671 4672		$blocks_metadata          = static::get_blocks_metadata();4673		$style_options            = array( 'include_block_style_variations' => true ); // Allow variations data.4674		$style_nodes              = static::get_style_nodes( $theme_json, $blocks_metadata, $style_options );4675		$responsive_media_queries = static::get_viewport_media_queries( $theme_json['settings']['viewport'] ?? null );4676 4677		foreach ( $style_nodes as $metadata ) {4678			$input = _wp_array_get( $theme_json, $metadata['path'], array() );4679			if ( empty( $input ) ) {4680				continue;4681			}4682 4683			$block_name = in_array( 'blocks', $metadata['path'], true )4684				? static::get_block_name_from_metadata_path( $metadata )4685				: null;4686 4687			// The global styles custom CSS is not sanitized, but can only be edited by users with 'edit_css' capability.4688			if ( isset( $input['css'] ) && current_user_can( 'edit_css' ) ) {4689				$output = $input;4690			} else {4691				$output = static::remove_insecure_styles( $input );4692			}4693 4694			/*4695			 * Get a reference to element name from path.4696			 * $metadata['path'] = array( 'styles', 'elements', 'link' );4697			 */4698			$current_element = array_last( $metadata['path'] );4699 4700			/*4701			 * $output is stripped of pseudo selectors. Re-add and process them4702			 * or insecure styles here.4703			 */4704			if ( isset( static::VALID_ELEMENT_PSEUDO_SELECTORS[ $current_element ] ) ) {4705				foreach ( static::VALID_ELEMENT_PSEUDO_SELECTORS[ $current_element ] as $pseudo_selector ) {4706					if ( isset( $input[ $pseudo_selector ] ) ) {4707						$output[ $pseudo_selector ] = static::remove_insecure_styles( $input[ $pseudo_selector ] );4708					}4709				}4710			}4711 4712			// Re-add and process responsive breakpoint styles.4713			foreach ( array_keys( $responsive_media_queries ) as $breakpoint ) {4714				if ( isset( $input[ $breakpoint ] ) ) {4715					$output[ $breakpoint ] = static::remove_insecure_styles( $input[ $breakpoint ] );4716 4717					if ( isset( $input[ $breakpoint ]['elements'] ) ) {4718						$output[ $breakpoint ]['elements'] = static::remove_insecure_element_styles( $input[ $breakpoint ]['elements'], $responsive_media_queries );4719					}4720 4721					if ( isset( $input[ $breakpoint ]['blocks'] ) ) {4722						$output[ $breakpoint ]['blocks'] = static::remove_insecure_inner_block_styles( $input[ $breakpoint ]['blocks'], $responsive_media_queries );4723					}4724 4725					if ( $block_name && isset( static::VALID_BLOCK_PSEUDO_SELECTORS[ $block_name ] ) ) {4726						foreach ( static::VALID_BLOCK_PSEUDO_SELECTORS[ $block_name ] as $pseudo_selector ) {4727							if ( isset( $input[ $breakpoint ][ $pseudo_selector ] ) ) {4728								$output[ $breakpoint ][ $pseudo_selector ] = static::remove_insecure_styles( $input[ $breakpoint ][ $pseudo_selector ] );4729							}4730						}4731					}4732 4733					// Responsive custom CSS is allowed for users with 'edit_css' capability.4734					if ( isset( $input[ $breakpoint ]['css'] ) && current_user_can( 'edit_css' ) ) {4735						$output[ $breakpoint ]['css'] = $input[ $breakpoint ]['css'];