Ticket #32495: 32495.3.diff

src/wp-includes/class-wp-admin-bar.php

@@ -477 +477 @@
                 $is_parent = ! empty( $node->children );
                 $has_link  = ! empty( $node->href );
 
-                $tabindex = isset( $node->meta['tabindex'] ) ? (int) $node->meta['tabindex'] : '';
-                $aria_attributes = $tabindex ? 'tabindex="' . $tabindex . '"' : '';
+                // Allow only numeric values, then casted to integers, and allow a tabindex value of `0` for a11y.
+                $tabindex = ( isset( $node->meta['tabindex'] ) && is_numeric( $node->meta['tabindex'] ) ) ? (int) $node->meta['tabindex'] : '';
+                $aria_attributes = is_int( $tabindex ) ? 'tabindex="' . $tabindex . '"' : '';
 
                 $menuclass = '';
 

src/wp-includes/css/admin-bar.css

@@ -286 +286 @@
 #wpadminbar .quicklinks .ab-sub-wrapper .menupop.hover > a,
 #wpadminbar .quicklinks .menupop.hover ul li a:hover,
 #wpadminbar .quicklinks .menupop.hover ul li a:focus,
+#wpadminbar .quicklinks .menupop.hover ul li div[tabindex]:hover,
+#wpadminbar .quicklinks .menupop.hover ul li div[tabindex]:focus,
 #wpadminbar.nojs .quicklinks .menupop:hover ul li a:hover,
 #wpadminbar.nojs .quicklinks .menupop:hover ul li a:focus,
 #wpadminbar li:hover .ab-icon:before,