Changeset 43270

Timestamp:

05/15/2018 02:07:32 PM (5 years ago)

Author:

azaozz

Message:

Privacy: Escape comment URLs in personal export file to prevent XSS.

There doesn't appear to be any way for an attacker to introduce malicious input into the URL, unless a plugin is filtering the URL to add it, but it's better to be safe than sorry.

Props birgire.
Merges [43245] to the 4.9 branch.
Fixes #44054.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-includes/comment.php (modified) (1 diff)

branches/4.9/src/wp-includes/comment.php

@@ -3238 +3238 @@
                 case 'comment_link':
                     $value = get_comment_link( $comment->comment_ID );
-                    $value = '<a href="' . $value . '" target="_blank" rel="noreferrer noopener">' . $value . '</a>';
+                    $value = sprintf(
+                        '<a href="%s" target="_blank" rel="noreferrer noopener">%s</a>',
+                        esc_url( $value ),
+                        esc_html( $value )
+                    );
                     break;
             }