Changeset 58479 for branches/6.2/src/wp-includes/html-api/class-wp-html-tag-processor.php

Timestamp:

06/24/2024 03:13:02 PM (2 years ago)

Author:

audrasjb

Message:

Grouped Backports to the 6.2 branch.

• Editor: Fix Path Traversal issue on Windows in Template-Part Block.
• Editor: Sanitize Template Part HTML tag on save.
• HTML API: Run URL attributes through esc_url().

Merges [58470], [58471], [58472] and [58473] to the 6.2 branch.
Props xknown, peterwilsoncc, jorbin, bernhard-reiter, azaozz, dmsnell, gziolo.

File:

• branches/6.2/src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (1 diff)

branches/6.2/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -1868 +1868 @@
                         $updated_attribute = $name;
                 } else {
-                        $escaped_new_value = esc_attr( $value );
+                        $comparable_name = strtolower( $name );
+
+                        /*
+                         * Escape URL attributes.
+                         *
+                         * @see https://html.spec.whatwg.org/#attributes-3
+                         */
+                        $escaped_new_value = in_array( $comparable_name, wp_kses_uri_attributes() ) ? esc_url( $value ) : esc_attr( $value );
                         $updated_attribute = "{$name}=\"{$escaped_new_value}\"";
                 }