Changeset 45979

Timestamp:

09/04/2019 05:11:22 PM (5 years ago)

Author:

whyisjake

Message:

Update wp.a11y.speak() to sanitize HTML before display.

Props iandunn, adamsilverstein, sstoqnov, peterwilsoncc

Location:

trunk

Files:

• src/js/_enqueues/admin/post.js (modified) (1 diff)
• src/js/_enqueues/wp/a11y.js (modified) (1 diff)
• src/js/_enqueues/wp/customize/nav-menus.js (modified) (1 diff)
• src/js/_enqueues/wp/sanitize.js (modified) (2 diffs)
• src/js/_enqueues/wp/updates.js (modified) (1 diff)
• src/wp-includes/script-loader.php (modified) (4 diffs)
• tests/phpunit/tests/dependencies/scripts.php (modified) (1 diff)
• tests/qunit/index.html (modified) (1 diff)

trunk/src/js/_enqueues/admin/post.js

@@ -796 +796 @@
 
             // Update "Status:" to currently selected status.
-            $('#post-status-display').html($('option:selected', postStatus).text());
+            $('#post-status-display').text(
+                wp.sanitize.stripTagsAndEncodeText( $('option:selected', postStatus).text() ) // Remove any potential tags from post status text.
+            );
 
             // Show or hide the "Save Draft" button.

trunk/src/js/_enqueues/wp/a11y.js

@@ -28 +28 @@
         clear();
 
-        // Ensure only text is sent to screen readers.
-        message = $( '<p>' ).html( message ).text();
+        // Remove HTML tags, ensuring only text is sent to screen readers.
+        message = wp.sanitize.stripTagsAndEncodeText( message );
 
         /*

trunk/src/js/_enqueues/wp/customize/nav-menus.js

@@ -3457 +3457 @@
     function displayNavMenuName( name ) {
         name = name || '';
-        name = $( '<div>' ).text( name ).html(); // Emulate esc_html() which is used in wp-admin/nav-menus.php.
+        name = wp.sanitize.stripTagsAndEncodeText( name ); // Remove any potential tags from name.
         name = $.trim( name );
         return name || api.Menus.data.l10n.unnamed;

trunk/src/js/_enqueues/wp/sanitize.js

@@ -24 +24 @@
             text = text || '';
 
-            return text
-                .replace( /<!--[\s\S]*?(-->|$)/g, '' )
-                .replace( /<(script|style)[^>]*>[\s\S]*?(<\/\1>|$)/ig, '' )
-                .replace( /<\/?[a-z][\s\S]*?(>|$)/ig, '' );
+            // Do the replacement.
+            var _text = text
+                    .replace( /<!--[\s\S]*?(-->|$)/g, '' )
+                    .replace( /<(script|style)[^>]*>[\s\S]*?(<\/\1>|$)/ig, '' )
+                    .replace( /<\/?[a-z][\s\S]*?(>|$)/ig, '' );
+
+            // If the initial text is not equal to the modified text,
+            // do the search-replace again, until there is nothing to be replaced.
+            if ( _text !== text ) {
+                return wp.sanitize.stripTags( _text );
+            }
+
+            // Return the text with stripped tags.
+            return _text;
         },
 
@@ -42 +52 @@
 
             try {
-                textarea.innerHTML = _text;
+                textarea.textContent = _text;
                 _text = wp.sanitize.stripTags( textarea.value );
             } catch ( er ) {}

trunk/src/js/_enqueues/wp/updates.js

@@ -263 +263 @@
         if ( 'undefined' !== typeof response.debug && window.console && window.console.log ) {
             _.map( response.debug, function( message ) {
-                window.console.log( $( '<p />' ).html( message ).text() );
+                // Remove all HTML tags and write a message to the console.
+                window.console.log( wp.sanitize.stripTagsAndEncodeText( message ) );
             } );
         }

trunk/src/wp-includes/script-loader.php

@@ -881 +881 @@
     );
 
-    $scripts->add( 'wp-a11y', "/wp-includes/js/wp-a11y$suffix.js", array( 'jquery' ), false, 1 );
+    $scripts->add( 'wp-sanitize', "/wp-includes/js/wp-sanitize$suffix.js", array(), false, 1 );
+
+    $scripts->add( 'wp-a11y', "/wp-includes/js/wp-a11y$suffix.js", array( 'jquery', 'wp-sanitize' ), false, 1 );
 
     $scripts->add( 'sack', "/wp-includes/js/tw-sack$suffix.js", array(), '1.6.1', 1 );
@@ -1488 +1490 @@
     $scripts->add( 'customize-preview-widgets', "/wp-includes/js/customize-preview-widgets$suffix.js", array( 'jquery', 'wp-util', 'customize-preview', 'customize-selective-refresh' ), false, 1 );
 
-    $scripts->add( 'customize-nav-menus', "/wp-admin/js/customize-nav-menus$suffix.js", array( 'jquery', 'wp-backbone', 'customize-controls', 'accordion', 'nav-menu' ), false, 1 );
+    $scripts->add( 'customize-nav-menus', "/wp-admin/js/customize-nav-menus$suffix.js", array( 'jquery', 'wp-backbone', 'customize-controls', 'accordion', 'nav-menu', 'wp-sanitize' ), false, 1 );
     $scripts->add( 'customize-preview-nav-menus', "/wp-includes/js/customize-preview-nav-menus$suffix.js", array( 'jquery', 'wp-util', 'customize-preview', 'customize-selective-refresh' ), false, 1 );
 
@@ -1573 +1575 @@
         );
 
-        $scripts->add( 'post', "/wp-admin/js/post$suffix.js", array( 'suggest', 'wp-lists', 'postbox', 'tags-box', 'underscore', 'word-count', 'wp-a11y' ), false, 1 );
+        $scripts->add( 'post', "/wp-admin/js/post$suffix.js", array( 'suggest', 'wp-lists', 'postbox', 'tags-box', 'underscore', 'word-count', 'wp-a11y', 'wp-sanitize' ), false, 1 );
         did_action( 'init' ) && $scripts->localize(
             'post',
@@ -1701 +1703 @@
         );
 
-        $scripts->add( 'updates', "/wp-admin/js/updates$suffix.js", array( 'jquery', 'wp-util', 'wp-a11y' ), false, 1 );
+        $scripts->add( 'updates', "/wp-admin/js/updates$suffix.js", array( 'jquery', 'wp-util', 'wp-a11y', 'wp-sanitize' ), false, 1 );
         did_action( 'init' ) && $scripts->localize(
             'updates',

trunk/tests/phpunit/tests/dependencies/scripts.php

@@ -693 +693 @@
 
         $ver       = get_bloginfo( 'version' );
-        $expected  = "<script type='text/javascript' src='/wp-admin/load-scripts.php?c=0&amp;load%5Bchunk_0%5D=jquery-core,jquery-migrate,wp-a11y&amp;ver={$ver}'></script>\n";
+        $expected  = "<script type='text/javascript' src='/wp-admin/load-scripts.php?c=0&amp;load%5Bchunk_0%5D=jquery-core,jquery-migrate,wp-sanitize,wp-a11y&amp;ver={$ver}'></script>\n";
         $expected .= "<script type='text/javascript'>\nconsole.log(\"before\");\n</script>\n";
         $expected .= "<script type='text/javascript' src='http://example.com'></script>\n";

trunk/tests/qunit/index.html

@@ -77 +77 @@
         <script src="../../build/wp-includes/js/customize-models.js"></script>
         <script src="../../build/wp-includes/js/shortcode.js"></script>
++       <script src="../../build/wp-includes/js/wp-sanitize.js"></script>
         <script src="../../build/wp-admin/js/customize-controls.js"></script>
         <script src="../../build/wp-includes/js/api-request.js"></script>