Changeset 59831

Timestamp:

02/17/2025 04:23:52 PM (11 months ago)

Author:

johnbillion

Message:

Security: Remove use of innerHTML in the the_block_template_skip_link() function.

There is no need to support HTML in this string and switching to innerText helps facilitate a more restrictive Content Security Policy.

Props micromadness, sabernhardt

Fixes #58765

File:

• trunk/src/wp-includes/theme-templates.php (modified) (1 diff)

trunk/src/wp-includes/theme-templates.php

@@ -206 +206 @@
         skipLink.id = 'wp-skip-link';
         skipLink.href = '#' + skipLinkTargetID;
-        skipLink.innerHTML = '<?php /* translators: Hidden accessibility text. */ esc_html_e( 'Skip to content' ); ?>';
+        skipLink.innerText = '<?php /* translators: Hidden accessibility text. Do not use HTML entities (&nbsp;, etc.). */ esc_html_e( 'Skip to content' ); ?>';
 
         // Inject the skip link.