Icons: Reject icon names ending in a hyphen or underscore. - #12624

t-hamano · 2026-07-21T12:23:03Z

There was a mismatch in the validation of allowed icon names. The REST route does not allow names ending with _ or -, but the icon registry does. While names ending with those characters are not supposed to be allowed, I believe a discrepancy arose due to repeated synchronization between Gutenberg and core. This mismatch does not exist on the Gutenberg side.

As a result of this PR, the rules for icon names expected by core and Gutenberg will be completely consistent.

Trac ticket: https://core.trac.wordpress.org/ticket/64847

Use of AI Tools

Used for: Initial code skeleton and test suggestions; final implementation and tests were reviewed and edited by me.

`WP_Icons_Registry::register()` validated the unqualified icon name with `^[a-z0-9][a-z0-9_-]*$`, which allows a trailing hyphen or underscore. The single icon REST route, the collection routes, the collection registry, and the `collection` query parameter schema all use `^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$`, which does not. An icon named `my-collection/my-icon-` could therefore be registered and returned by the collection endpoint, while `/wp/v2/icons/my-collection/my-icon-` never matched the route and responded with a 404. Align the registry with the pattern used everywhere else and update the error message to mention the trailing character constraint. See #64847. Co-Authored-By: Claude <noreply@anthropic.com>

github-actions · 2026-07-21T12:30:09Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props wildworks, tyxla, mukesh27.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Copilot

Pull request overview

Aligns core’s icon-name validation with the REST API (and Gutenberg) by rejecting icon names that end with - or _, eliminating an inconsistency between registration and REST routing.

Changes:

Tightens WP_Icons_Registry::register() validation so unqualified icon names must end with a lowercase letter or digit.
Updates the associated _doing_it_wrong() message to reflect the new rule.
Adjusts PHPUnit data providers to move trailing - / _ cases from “valid” to “invalid”.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`src/wp-includes/class-wp-icons-registry.php`	Updates icon-name regex and error message to forbid trailing `-` / `_`.
`tests/phpunit/tests/icons/wpIconsRegistry.php`	Updates valid/invalid icon-name test cases to match the tightened rules.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

t-hamano · 2026-07-21T14:20:46Z

-			'underscore at the end'  => array( 'test-collection/my-icon_' ),
-			'hyphen at the end'      => array( 'test-collection/my-icon-' ),
+			'hyphen in the name'     => array( 'test-collection/my-icon' ),
 		);


Consider making the “simple name” example truly simple (no hyphen) to keep each case distinct.

Addressed in 00881ad

github-actions · 2026-07-21T12:38:26Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

tyxla

LGTM, maybe just change the regex group to non-capturing for parity with the REST controller.

tyxla · 2026-07-21T14:11:01Z

 			'underscore in the name' => array( 'test-collection/my_icon' ),
-			'underscore at the end'  => array( 'test-collection/my-icon_' ),
-			'hyphen at the end'      => array( 'test-collection/my-icon-' ),
+			'hyphen in the name'     => array( 'test-collection/my-icon' ),


If we have a separate "hyphen in the name" case, maybe we should remove the hyphens from the above cases?

Nice idea, fixed in 00881ad

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

tests/phpunit/tests/icons/wpIconsRegistry.php:91

data_valid_icon_names() includes two different cases (simple name and hyphen in the name) that both use the exact same icon name (test-collection/my-icon), so the second case doesn't add coverage and makes the data set misleading. Use a distinct hyphenated name for the hyphen in the name case (or remove it).

			'simple name'            => array( 'test-collection/my-icon' ),
			'digit at the start'     => array( 'test-collection/1-icon' ),
			'digit in the name'      => array( 'test-collection/my-1-icon' ),
			'digit at the end'       => array( 'test-collection/icon1' ),
			'underscore in the name' => array( 'test-collection/my_icon' ),
			'hyphen in the name'     => array( 'test-collection/my-icon' ),
		);

Now that the data provider has a dedicated 'hyphen in the name' case, the remaining cases no longer need hyphens. 'simple name' was an exact duplicate of the new case, and the digit cases mixed hyphens into what should only exercise digit placement. Each case now covers one concern. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Isolating each character class in the valid name data provider dropped the cases where a digit sits next to a hyphen or an underscore. Those forms stay valid under the updated validation, which only rejects a trailing hyphen or underscore, so add them back as dedicated cases instead of folding them into the isolated ones. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

t-hamano · 2026-07-21T15:25:35Z

After committing this PR, I plan to backport the use of non-capturing groups and improvements to unit tests to Gutenberg.

tyxla · 2026-07-21T15:27:09Z

Thanks @t-hamano 🙌

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

A one-character name is the shortest string the pattern must accept, so it guards the lower boundary against a future pattern change requiring two or more characters. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

The name validation in `WP_Icons_Registry::register()` allowed unqualified icon names to end with a hyphen or an underscore, while the REST API route for icons did not, so an icon could be registered under a name that was unreachable through the REST API. Tighten the regular expression so that an unqualified icon name must both start and end with a lowercase letter or digit. Developed in: #12624 Follow-up to [62748]. Props mukesh27, tyxla, wildworks. See #64847. git-svn-id: https://develop.svn.wordpress.org/trunk@62821 602fd350-edb4-49c9-b593-d223f7449a82

t-hamano · 2026-07-22T02:44:17Z

This PR was commited as r62821

The name validation in `WP_Icons_Registry::register()` allowed unqualified icon names to end with a hyphen or an underscore, while the REST API route for icons did not, so an icon could be registered under a name that was unreachable through the REST API. Tighten the regular expression so that an unqualified icon name must both start and end with a lowercase letter or digit. Developed in: WordPress/wordpress-develop#12624 Follow-up to [62748]. Props mukesh27, tyxla, wildworks. See #64847. Built from https://develop.svn.wordpress.org/trunk@62821 git-svn-id: http://core.svn.wordpress.org/trunk@62101 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Sync `data_valid_icon_names` with the equivalent provider in WordPress/wordpress-develop#12624 so that it no longer overlaps with `data_invalid_icon_names` (names ending in a hyphen or underscore are invalid), and add coverage for single-character names and digits adjacent to separators. Co-authored-by: t-hamano <wildworks@git.wordpress.org>

Sync `data_valid_icon_names` with the equivalent provider in WordPress/wordpress-develop#12624 so that it no longer overlaps with `data_invalid_icon_names` (names ending in a hyphen or underscore are invalid), and add coverage for single-character names and digits adjacent to separators. Co-authored-by: t-hamano <wildworks@git.wordpress.org> Source: WordPress/gutenberg@d272b61

Sync `data_valid_icon_names` with the equivalent provider in WordPress/wordpress-develop#12624 so that it no longer overlaps with `data_invalid_icon_names` (names ending in a hyphen or underscore are invalid), and add coverage for single-character names and digits adjacent to separators. Co-authored-by: t-hamano <wildworks@git.wordpress.org> Source: WordPress/gutenberg@137e257

Sync `data_valid_icon_names` with the equivalent provider in WordPress/wordpress-develop#12624 so that it no longer overlaps with `data_invalid_icon_names` (names ending in a hyphen or underscore are invalid), and add coverage for single-character names and digits adjacent to separators. Co-authored-by: t-hamano <wildworks@git.wordpress.org>

Sync `data_valid_icon_names` with the equivalent provider in WordPress/wordpress-develop#12624 so that it no longer overlaps with `data_invalid_icon_names` (names ending in a hyphen or underscore are invalid), and add coverage for single-character names and digits adjacent to separators. Co-authored-by: t-hamano <wildworks@git.wordpress.org> Source: WordPress/gutenberg@e055dbf

Copilot AI review requested due to automatic review settings July 21, 2026 12:23

t-hamano marked this pull request as ready for review July 21, 2026 12:24

t-hamano requested a review from tyxla July 21, 2026 12:24

Copilot started reviewing on behalf of t-hamano July 21, 2026 12:29 View session