Ticket #20009: 20009.4.diff

src/wp-includes/post-template.php

@@ -454 +454 @@
  */
 function post_class( $class = '', $post_id = null ) {
         // Separates classes with a single space, collates classes for post DIV.
-        echo 'class="' . join( ' ', get_post_class( $class, $post_id ) ) . '"';
+        echo 'class="' . esc_attr( join( ' ', get_post_class( $class, $post_id ) ) ) . '"';
 }
 
 /**
@@ -590 +590 @@
  */
 function body_class( $class = '' ) {
         // Separates class names with a single space, collates class names for body element.
-        echo 'class="' . join( ' ', get_body_class( $class ) ) . '"';
+        echo 'class="' . esc_attr( join( ' ', get_body_class( $class ) ) ) . '"';
 }
 
 /**

tests/phpunit/tests/post/bodyClass.php

@@ +1 @@
+<?php
+
+/**
+ * @group post
+ * @covers ::body_class
+ */
+class Tests_Post_BodyClass extends WP_UnitTestCase {
+        protected $post_id;
+
+        public function setUp() {
+                parent::setUp();
+                $this->post_id = self::factory()->post->create();
+        }
+
+        public function test_body_class() {
+                $expected = 'class="' . join( ' ', get_body_class( '', $this->post_id ) ) . '"';
+                $this->expectOutputString( $expected );
+                body_class( '', $this->post_id );
+        }
+
+        public function test_body_class_extra_esc_attr() {
+                $classes              = get_body_class( '', $this->post_id );
+                $escaped_again        = array_map( 'esc_attr', $classes );
+                $escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
+
+                $this->expectOutputString( $escaped_another_time );
+                body_class( '', $this->post_id );
+        }
+}

tests/phpunit/tests/post/postClass.php

@@ +1 @@
+<?php
+
+/**
+ * @group post
+ * @covers ::post_class
+ */
+class Tests_Post_PostClass extends WP_UnitTestCase {
+        protected $post_id;
+
+        public function setUp() {
+                parent::setUp();
+                $this->post_id = self::factory()->post->create();
+        }
+
+        public function test_post_class() {
+                $expected = 'class="' . join( ' ', get_post_class( '', $this->post_id ) ) . '"';
+                $this->expectOutputString( $expected );
+                post_class( '', $this->post_id );
+        }
+
+        public function test_post_class_extra_esc_attr() {
+                $classes              = get_post_class( '', $this->post_id );
+                $escaped_again        = array_map( 'esc_attr', $classes );
+                $escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
+
+                $this->expectOutputString( $escaped_another_time );
+                post_class( '', $this->post_id );
+        }
+}