Script Loader: Add an API for filtering inline style attributes

[Sukhendu2002]

What this PR does

Adds a structured API for generating and filtering inline <style> tags, mirroring the existing inline script tag API:

• Adds wp_get_inline_style_tag( string $data, array $attributes = array() ).
• Adds wp_print_inline_style_tag().
• Adds the wp_inline_style_attributes filter, which receives the attributes and the CSS.
• Uses WP_HTML_Tag_Processor for safe attribute and CSS handling, including escaping of a closing </style> in the CSS.
• Documents $attributes as array<string, string|bool>, matching wp_get_inline_script_tag().

This allows plugins to add attributes such as CSP nonces without modifying complete HTML strings. The script portion of the original ticket is already covered by wp_inline_script_attributes, so this PR focuses on the remaining inline style functionality.

Core STYLE tags routed through the API

All <style> tags constructed by core now go through the new API, so that they all receive the filtered attributes. This is especially important in the admin, where a CSP is most valuable.

• WP_Styles output for normal, no-source, and concatenated inline styles, plus the hoisted extra block library styles and block support styles in script-loader.php.
• Theme features: custom background, custom CSS, and custom logo header styles.
• Font faces printed by WP_Font_Face.
• Recent Comments widget styles.
• Default gallery shortcode styles.
• Legacy Widget block previews (block render and REST preview iframe).
• Default wp_die() handler, with a fallback to a literal <style> when it is called before script-loader.php and the HTML API are loaded.
• Interim login, Multisite signup and activation pages.
• Admin: plugin information banner, site icon preview in General Settings.
• Customizer: preview loading style, highlighted widget style, site icon control template, and the site icon crop preview media template.
• Deprecated functions: emoji and embed styles, admin bar styles, skip link styles, the auto-sizes contain-intrinsic-size fix, and graceful_fail().
• Theme compat header.

Literal CSS is passed as a <<<'CSS' nowdoc (or a <<<CSS heredoc when interpolating), as is already done for <<<'JS' with inline scripts, so IDEs apply CSS syntax highlighting.

URLs in url() are escaped late with esc_url_raw() rather than esc_url(), since HTML character references are not decoded in STYLE elements, and are wrapped in double quotes, since esc_url_raw() strips double quotes but not single quotes or parentheses.

Intentionally not changed

• Bundled themes and Hello Dolly, which support older WordPress versions.
• src/wp-includes/build/pages/*, which is generated from Gutenberg.
• The personal data export file in privacy-tools.php, since it is a static HTML file where a per-request nonce does not belong.

Testing

New tests in tests/phpunit/tests/dependencies/wpInlineStyleTag.php, tests/phpunit/tests/dependencies/styles.php, and tests/phpunit/tests/template.php use assertEqualHTML() and WP_HTML_Tag_Processor to verify the output, including that the core inline styles have the filtered attributes.

Trac ticket: https://core.trac.wordpress.org/ticket/51325

Use of AI Tools

AI assistance: Yes
Tool(s): OpenAI Codex
Model(s): GPT-5.6
Used for: Initial code skeleton, test suggestions and code review; final implementation and tests were reviewed and edited by me.

Additional commits were made with Claude Code (Claude Opus 5.5) at the direction of @westonruter, to make the tests more robust with assertEqualHTML() and WP_HTML_Tag_Processor, to route the remaining core <style> tags through the new API, and to address code review findings. The changes were reviewed by @westonruter.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

🤖 Generated with Claude Code

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props sukhendu2002, westonruter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.