Ticket #30883: patch.3.diff

src/wp-includes/formatting.php

@@ -1350 +1350 @@
  * @return string The sanitized value
  */
 function sanitize_html_class( $class, $fallback = '' ) {
-        //Strip out any % encoded octets
+        // Strip out any % encoded octets
         $sanitized = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $class );
 
-        //Limit to A-Z,a-z,0-9,_,-
+        // Limit to A-Z, a-z, 0-9, _, -
         $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized );
 
-        if ( '' == $sanitized )
+        // Check if only numbers, hyphens or underscores left
+        if ( '' == preg_replace( '/[0-9_-]/', '', $sanitized ) ) {
                 $sanitized = $fallback;
+        }
 
         /**
          * Filter a sanitized HTML class string.

src/wp-includes/post-template.php

@@ -475 +475 @@
                                 if ( 'post_tag' == $taxonomy ) {
                                         $classes[] = 'tag-' . sanitize_html_class( $term->slug, $term->term_id );
                                 } else {
-                                        $classes[] = sanitize_html_class( $taxonomy . '-' . $term->slug, $taxonomy . '-' . $term->term_id );
+                                        $classes[] = $taxonomy . '-' . sanitize_html_class( $term->slug, $term->term_id );
                                 }
                         }
                 }

new file tests/phpunit/tests/formatting/SanitizeHtmlClass.php

@@ +1 @@
+<?php
+
+/**
+ * @group formatting
+ */
+class Tests_Formatting_SanitizeHtmlClass extends WP_UnitTestCase {
+
+        /**
+         * @covers ::sanitize_html_class
+         */
+        public function test_expected() {
+                $text = 'test';
+                $result = sanitize_html_class( $text );
+                $this->assertEquals( $text, $result );
+        }
+
+        /**
+         * @covers ::sanitize_html_class
+         */
+        public function test_fallback_empty() {
+                $result = sanitize_html_class( '' );
+                $this->assertEquals( '', $result );
+        }
+
+        /**
+         * @covers ::sanitize_html_class
+         */
+        public function test_fallback_with_only_hyphens() {
+                $result = sanitize_html_class( '---' );
+                $this->assertEquals( '', $result );
+        }
+
+        /**
+         * @covers ::sanitize_html_class
+         * @ticket 30883
+         */
+        public function test_fallback_hyphens_after_percent_encoded_octets() {
+                $s1 = sanitize_html_class( '%d0%b2%d1%82%d0%be%d1%80%d0%b0%d1%8f-%d1%80%d1%83%d0%b1%d1%80%d0%b8%d0%ba%d0%b0' );
+                $s2 = sanitize_html_class( '%d0%bf%d0%b5%d1%80%d0%b2%d0%b0%d1%8f-%d1%80%d1%83%d0%b1%d1%80%d0%b8%d0%ba%d0%b0' );
+
+                $this->assertEquals( '', $s1 );
+                $this->assertEquals( '', $s2 );
+        }
+
+        /**
+         * @covers ::sanitize_html_class
+         */
+        public function test_fallback_with_non_letter_characters() {
+                $result = sanitize_html_class( '-_0123456789' );
+                $this->assertEquals( '', $result );
+        }
+
+}