Changeset 58475 for branches/6.4/src/wp-includes/html-api/class-wp-html-tag-processor.php

Timestamp:

06/24/2024 03:08:05 PM (2 years ago)

Author:

audrasjb

Message:

Grouped Backports to the 6.4 branch.

• Editor: Fix Path Traversal issue on Windows in Template-Part Block.
• Editor: Sanitize Template Part HTML tag on save.
• HTML API: Run URL attributes through esc_url().

Merges [58470], [58471], [58472] and [58473] to the 6.4 branch.
Props xknown, peterwilsoncc, jorbin, bernhard-reiter, azaozz, dmsnell, gziolo.

File:

• branches/6.4/src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (1 diff)

branches/6.4/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -2072 +2072 @@
             $updated_attribute = $name;
         } else {
-            $escaped_new_value = esc_attr( $value );
+            $comparable_name = strtolower( $name );
+
+            /*
+             * Escape URL attributes.
+             *
+             * @see https://html.spec.whatwg.org/#attributes-3
+             */
+            $escaped_new_value = in_array( $comparable_name, wp_kses_uri_attributes() ) ? esc_url( $value ) : esc_attr( $value );
             $updated_attribute = "{$name}=\"{$escaped_new_value}\"";
         }