Changeset 54802 for trunk/src/wp-includes/media.php

Timestamp:

11/11/2022 12:59:20 AM (3 years ago)

Author:

peterwilsoncc

Message:

Media: Prevent decoding attribute corrupting JSON data.

Workaround wp_img_tag_add_decoding_attr() potentially breaking JavaScript and JSON data by limiting the addition of the decoding attribute to image tags using unescaped double quoted attributes src attributes.

Props rodricus, TimothyBlynJacobs, joelmadigan, mw108, adamsilverstein, flixos90, desrosj, mukesh27.
Fixes #56969.

File:

• trunk/src/wp-includes/media.php (modified) (1 diff)

trunk/src/wp-includes/media.php

@@ -1963 +1963 @@
  */
 function wp_img_tag_add_decoding_attr( $image, $context ) {
+    // Only apply the decoding attribute to images that have a src attribute that
+    // starts with a double quote, ensuring escaped JSON is also excluded.
+    if ( false === strpos( $image, ' src="' ) ) {
+        return $image;
+    }
+
     /**
      * Filters the `decoding` attribute value to add to an image. Default `async`.