Custom HTML Block Preview doesn't respect unfiltered_html capability

[MadtownLems]

Description

When a user lacks the unfiltered_html capability, they cannot use tags such as 'iframe' in their posts. A very common situation where users lack unfiltered_html is anyone but Network Administrators in a MultiSite.

However, then using a Custom HTML block, these users can still have their unfiltered_html rendered in the Preview of the block. This is, at a minimum, a poor User Experience situation because the Block Preview shows something that they front end simply won't. (It likely has security concerns as well.)

Note that while simply only rendering the filtered HTML would be an improvement, I think an even better approach would be displaying a warning alongside the preview that indicates that some content has been removed or modified.

Step-by-step reproduction instructions

1. Be a user without 'unfiltered_html' capability. (Once again, the easiest way is probably to be anything but a Network Administrator in multisite)
2. Add a Custom HTML block to a page or post.
3. Add iframe markup to the Custom HTML block.
4. Switch the block to Preview mode, and see that the iframe is rendered.

Screenshots, screen recording, code snippet

Environment info

5.8.3 MultiSite (no Gutenberg plugin installed)

Please confirm that you have searched existing issues in the repo.

Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

Yes

[bobbingwide]

This issue was accidentally reproduced by members of WordPress Portsmouth and Brighton meetup groups while attempting to debug a problem where the iframe disappeared when edited by a normal Administrator but remained when edited by a Super Admin.

Reproduced in 6.1-RC2

[andreawetzel]

I can confirm this is still an issue on 6.5.2. It would be great if wp_kses is run at time of preview for the Custom HTML block. When a site user who doesn't have unfiltered_html capabilities adds HTML that will be filtered, they don't know that it will be removed until they preview the page or refresh the editor.