Changeset 58472

Timestamp:

06/24/2024 02:43:08 PM (2 years ago)

Author:

audrasjb

Message:

HTML API: Run URL attributes through esc_url().

Props dmsnell, xknown, jorbin, gziolo.

File:

• trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (1 diff)

trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -2973 +2973 @@
                         $updated_attribute = $name;
                 } else {
+                        $tag_name        = $this->get_tag();
+                        $comparable_name = strtolower( $name );
+
+                        /*
+                         * Escape URL attributes.
+                         *
+                         * @see https://html.spec.whatwg.org/#attributes-3
+                         */
                         $escaped_new_value = esc_attr( $value );
-                        $updated_attribute = "{$name}=\"{$escaped_new_value}\"";
+                        $updated_attribute = wp_kses_one_attr( "{$comparable_name}=\"{$escaped_new_value}\"", $tag_name );
                 }