Changeset 62494

Timestamp:

06/12/2026 01:44:50 AM (2 months ago)

Author:

westonruter

Message:

Media: Consistently escape URLs in attachment download links and JS data.

The "Download file" link in attachment_submitbox_metadata() escaped its href with esc_attr(), which only HTML-encodes the value. Use esc_url() instead, the correct function for a URL in an href attribute, since $att_url comes from wp_get_attachment_url(). This applies the same escaping method for the Download link in the media list table output by WP_Media_List_Table::_get_row_actions().

Apply the same correction to wp_prepare_attachment_for_js(), wrapping the attachment, intermediate size, full-size, original image, and image source URLs in esc_url_raw() so the Backbone-rendered media UI emits URLs filtered through clean_url just like the server-rendered templates.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/12062.
Follow-up to r21680, r47202, r55156, r55198, r55221.

Props thisismyurl, westonruter, sabernhardt, gazipress, jamesbregenzer, manhar, sanayasir, freewebmentor.
See #57574, #41474.
Fixes #65397.

Location:

trunk/src

Files:

• wp-admin/includes/media.php (modified) (1 diff)
• wp-includes/media.php (modified) (7 diffs)

trunk/src/wp-admin/includes/media.php

@@ -3388 +3388 @@
         </div>
         <div class="misc-pub-section misc-pub-download">
-                <a href="<?php echo esc_attr( $att_url ); ?>" download><?php _e( 'Download file' ); ?></a>
+                <a href="<?php echo esc_url( $att_url ); ?>" download><?php _e( 'Download file' ); ?></a>
         </div>
         <div class="misc-pub-section misc-pub-filename">

trunk/src/wp-includes/media.php

@@ -4574 +4574 @@
                 'title'         => $attachment->post_title,
                 'filename'      => wp_basename( get_attached_file( $attachment->ID ) ),
-                'url'           => $attachment_url,
+                'url'           => esc_url_raw( $attachment_url ),
                 'link'          => get_attachment_link( $attachment->ID ),
                 'alt'           => get_post_meta( $attachment->ID, '_wp_attachment_image_alt', true ),
@@ -4680 +4680 @@
                                         'height'      => $downsize[2],
                                         'width'       => $downsize[1],
-                                        'url'         => $downsize[0],
+                                        'url'         => esc_url_raw( $downsize[0] ),
                                         'orientation' => $downsize[2] > $downsize[1] ? 'portrait' : 'landscape',
                                 );
@@ -4696 +4696 @@
                                         'height'      => $height,
                                         'width'       => $width,
-                                        'url'         => $base_url . $size_meta['file'],
+                                        'url'         => esc_url_raw( $base_url . $size_meta['file'] ),
                                         'orientation' => $height > $width ? 'portrait' : 'landscape',
                                 );
@@ -4704 +4704 @@
                 if ( 'image' === $type ) {
                         if ( ! empty( $meta['original_image'] ) ) {
-                                $response['originalImageURL']  = wp_get_original_image_url( $attachment->ID );
+                                $original_image_url            = wp_get_original_image_url( $attachment->ID );
+                                $response['originalImageURL']  = $original_image_url ? esc_url_raw( $original_image_url ) : '';
                                 $response['originalImageName'] = wp_basename( wp_get_original_image_path( $attachment->ID ) );
                         }
 
-                        $sizes['full'] = array( 'url' => $attachment_url );
+                        $sizes['full'] = array( 'url' => esc_url_raw( $attachment_url ) );
 
                         if ( isset( $meta['height'], $meta['width'] ) ) {
@@ -4719 +4720 @@
                 } elseif ( $meta['sizes']['full']['file'] ) {
                         $sizes['full'] = array(
-                                'url'         => $base_url . $meta['sizes']['full']['file'],
+                                'url'         => esc_url_raw( $base_url . $meta['sizes']['full']['file'] ),
                                 'height'      => $meta['sizes']['full']['height'],
                                 'width'       => $meta['sizes']['full']['width'],
@@ -4758 +4759 @@
                         if ( is_array( $response_image_full ) ) {
                                 $response['image'] = array(
-                                        'src'    => $response_image_full[0],
+                                        'src'    => esc_url_raw( $response_image_full[0] ),
                                         'width'  => $response_image_full[1],
                                         'height' => $response_image_full[2],
@@ -4767 +4768 @@
                         if ( is_array( $response_image_thumb ) ) {
                                 $response['thumb'] = array(
-                                        'src'    => $response_image_thumb[0],
+                                        'src'    => esc_url_raw( $response_image_thumb[0] ),
                                         'width'  => $response_image_thumb[1],
                                         'height' => $response_image_thumb[2],