Changeset 51984 for trunk/src/wp-includes/formatting.php

Timestamp:

11/02/2021 06:46:36 PM (2 years ago)

Author:

johnjamesjacoby

Message:

Permalinks: Sanitize non-visible characters inside sanitize_title_with_dashes().

This change prevents non-visible characters in titles from creating encoded values in permalinks, opting instead for the following replacement strategy:

• Non-visible non-zero-width characters are replaced with hyphens
• Non-visible zero-width characters are removed entirely

Included with this change are 64 additional PHPUnit assertions to confirm that only the targeted non-visible characters are sanitized as intended.

Before this change, URLs would unintentionally contain encoded values where these non-visible characters were. After this change, URLs intentionally strip out or hyphenate these non-visible characters.

Props costdev, dhanendran, hellofromtonya, paaljoachim, peterwilsoncc, poena, sergeybiryukov.

Fixes #47912.

File:

• trunk/src/wp-includes/formatting.php (modified) (1 diff)

trunk/src/wp-includes/formatting.php

@@ -2289 +2289 @@
                 '%cc%84',
                 '%cc%8c',
+                // Non-visible characters that display without a width.
+                '%e2%80%8b',
+                '%e2%80%8c',
+                '%e2%80%8d',
+                '%e2%80%8e',
+                '%e2%80%8f',
+                '%e2%80%aa',
+                '%e2%80%ab',
+                '%e2%80%ac',
+                '%e2%80%ad',
+                '%e2%80%ae',
+                '%ef%bb%bf',
             ),
             '',
+            $title
+        );
+
+        // Convert non-visible characters that display with a width to hyphen.
+        $title = str_replace(
+            array(
+                '%e2%80%80',
+                '%e2%80%81',
+                '%e2%80%82',
+                '%e2%80%83',
+                '%e2%80%84',
+                '%e2%80%85',
+                '%e2%80%86',
+                '%e2%80%87',
+                '%e2%80%88',
+                '%e2%80%89',
+                '%e2%80%8a',
+                '%e2%80%a8',
+                '%e2%80%a9',
+                '%e2%80%af',
+            ),
+            '-',
             $title
         );