Index: src/wp-includes/post-template.php
===================================================================
--- src/wp-includes/post-template.php	(revision 48055)
+++ src/wp-includes/post-template.php	(working copy)
@@ -454,7 +454,7 @@
  */
 function post_class( $class = '', $post_id = null ) {
 	// Separates classes with a single space, collates classes for post DIV.
-	echo 'class="' . join( ' ', get_post_class( $class, $post_id ) ) . '"';
+	echo 'class="' . esc_attr( join( ' ', get_post_class( $class, $post_id ) ) ) . '"';
 }
 
 /**
@@ -590,7 +590,7 @@
  */
 function body_class( $class = '' ) {
 	// Separates class names with a single space, collates class names for body element.
-	echo 'class="' . join( ' ', get_body_class( $class ) ) . '"';
+	echo 'class="' . esc_attr( join( ' ', get_body_class( $class ) ) ) . '"';
 }
 
 /**
Index: tests/phpunit/tests/post/bodyClass.php
===================================================================
--- tests/phpunit/tests/post/bodyClass.php	(nonexistent)
+++ tests/phpunit/tests/post/bodyClass.php	(working copy)
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @group post
+ * @covers ::body_class
+ */
+class Tests_Post_BodyClass extends WP_UnitTestCase {
+	protected $post_id;
+
+	public function setUp() {
+		parent::setUp();
+		$this->post_id = self::factory()->post->create();
+	}
+
+	public function test_body_class() {
+		$expected = 'class="' . join( ' ', get_body_class( '', $this->post_id ) ) . '"';
+		$this->expectOutputString( $expected );
+		body_class( '', $this->post_id );
+	}
+
+	public function test_body_class_extra_esc_attr() {
+		$classes              = get_body_class( '', $this->post_id );
+		$escaped_again        = array_map( 'esc_attr', $classes );
+		$escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
+
+		$this->expectOutputString( $escaped_another_time );
+		body_class( '', $this->post_id );
+	}
+}

Property changes on: tests/phpunit/tests/post/bodyClass.php
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Index: tests/phpunit/tests/post/postClass.php
===================================================================
--- tests/phpunit/tests/post/postClass.php	(nonexistent)
+++ tests/phpunit/tests/post/postClass.php	(working copy)
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @group post
+ * @covers ::post_class
+ */
+class Tests_Post_PostClass extends WP_UnitTestCase {
+	protected $post_id;
+
+	public function setUp() {
+		parent::setUp();
+		$this->post_id = self::factory()->post->create();
+	}
+
+	public function test_post_class() {
+		$expected = 'class="' . join( ' ', get_post_class( '', $this->post_id ) ) . '"';
+		$this->expectOutputString( $expected );
+		post_class( '', $this->post_id );
+	}
+
+	public function test_post_class_extra_esc_attr() {
+		$classes              = get_post_class( '', $this->post_id );
+		$escaped_again        = array_map( 'esc_attr', $classes );
+		$escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
+
+		$this->expectOutputString( $escaped_another_time );
+		post_class( '', $this->post_id );
+	}
+}

Property changes on: tests/phpunit/tests/post/postClass.php
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property