Add additional escaping to credit.php

[Viper007Bond]

/wp-admin/credits.php doesn't fully escape all of the data that it displays. It should be properly escaped like any other third party data.

What if WordPress.org were somehow compromised?

[nacin]

esc_url()'s seem fine. We send back entities for some names, though, and I would want to make sure that we aren't stomping any future solution to solve encoding issues — #17487.

If wordpress.org were somehow compromised, I feel like XSS on the credits page would be our least concern.

[chriscct7]

While malicious use of other parts of WordPress.org could do more damage, they are significantly harder to use without explicit knowledge of how the .org architecture works. In light of the jQuery.com hack, this is pretty low hanging to do. Patch needs refresh. Good first bug though.

[protechig]

Replying to chriscct7:

While malicious use of other parts of WordPress.org could do more damage, they are significantly harder to use without explicit knowledge of how the .org architecture works. In light of the jQuery.com hack, this is pretty low hanging to do. Patch needs refresh. Good first bug though.

I would love to try to tackle this bug. It would be my first patch, I do want to get started contributing to WP. Would you be kind enough to point me in the right direction (an article) on the proper way to satanize this data, or even an example in another WP file that I can reference?

[chriscct7]

@protechig see the patch on this ticket, which needs to be refreshed. That covers most of the sanitization that would need to be done. See ​https://codex.wordpress.org/Data_Validation & ​https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data for references

[protechig]

Replying to chriscct7:

@protechig see the patch on this ticket, which needs to be refreshed. That covers most of the sanitization that would need to be done. See ​https://codex.wordpress.org/Data_Validation & ​https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data for references

Thanks for the swift reply! I'll go through those articles and update the patch. I took a look at this before I asked the question, these changes should be pretty straightforward.

[gtuk]

Replying to chriscct7:

@protechig see the patch on this ticket, which needs to be refreshed. That covers most of the sanitization that would need to be done. See ​https://codex.wordpress.org/Data_Validation & ​https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data for references

I updated the file as you suggested. Hope everything is as expected, otherwise let me know

[gtuk]

Replying to DrewAPicture:

What is the next part of the workflow if i'm the owner of this ticket now?

[DrewAPicture]

Replying to gtuk:

Replying to DrewAPicture:

What is the next part of the workflow if i'm the owner of this ticket now?

Assigning the ticket to you just has the effect of moving the ticket off of the "Unclaimed" list on the good-first-bug report.

At this point, you'd wait for developer feedback on your patch.

[chriscct7]

Will review this weekend, unless someone else gets to it first.

Early Review Re-Assignment: Open

[chriscct7]

Improves upon second patch by adding more strict checking on API return

[chriscct7]

Looks good. Added some strict checking on the API return, so if wp.org's api ever sent back an incomplete response we don't save that and then subsequently try to use that bad result.

[chriscct7]

We should make sure the user objects are populated before using them

[obenland]

Let's keep this to escaping. If the API result is screwed up in a way where properties are missing, it should spit out errors like that.

[chriscct7]

@obenland in that case use patch 2

[obenland]

esc_html( sprintf( __( 'WordPress is created by a <a href="%1$s">worldwide team</a> of passionate individuals. <a href="%2$s">Get involved in WordPress</a>.' )…
will not work since it contains html.

[obenland]

Could you refresh the patch and create it from root (rather than /trunk/)?

[chriscct7]

Yeah. Good catch re-esc_html. Didn't even notice that section was missing somehow

[obenland]

In 33032:

Add additional escaping to credits page.

Props Viper007Bond, gtuk for initial patch.
Fixes #21523.