Special characters in caption lead to failure of inserting images

[TobiasBg]

Found this when double-checking #22132:

1. Go to add a new post.
2. Click "Upload/Insert" (the "old" media upload).
3. Upload an image, or go to choose one from the media library.
4. Insert Title"<script>alert('Title');</script> in the "Caption" field.
5. Click "Insert into Post".

Instead of the image (or Shortcode) being added to the editor (with a somehow escaped caption field), the media upload iframe just gets a new content:

[/caption]'); /* ]]> */

Reproduced in 3.4.2 and trunk.

[MikeHansenMe]

screenshot of the error

[MikeHansenMe]

I was able to reproduce the error. It also allowed the alert on the front end. I am not sure if this will need to be addressed once the new media update is fully implemented.

[TobiasBg]

Use json_encode instead of addslashes

[TobiasBg]

I investigated this some more, and the problem is the argument that is passed to the JS send_to_editor function via PHP, in this line of wp-admin/includes/media.php.
Basically, addslashes() is not enough to protect against an input of

foo</script>bar

(in the Caption field in the old media uploader) prematurely ending the JS. This results in a script error, so that the remaining output is printed in the frame (as in the screenshot above).
Compare this generated HTML/JS (some attributes from the <img> and [caption] stripped):

/* <![CDATA[ */
var win = window.dialogArguments || opener || parent || top;
win.send_to_editor('[caption]<img src=\"http://example.com/img.jpg\" /> foo</script>bar[/caption]');
/* ]]> */

addslashes() only escaped the ' and " but leaves / untouched. This is then a problem for any input that contains </script>, as that ends the <script> block early. For other closing HTML tags (like </em>) this is no problem however.

Now, the old media uploader is no longer used by Core, but it's still being used in several plugins. And although this an edge case that can only be triggered with </script>, the fix is very easy: Let's use json_encode() instead of addslashes(), as that also escapes all /.
The attached patch 22135.patch​ does that.

[nacin]

Talked to gcorne about this; we both have a hunch there are some edge cases here. Since this is very low priority (it's the old modal) and not easy to trigger, I'm going to punt on this.

[chriscct7]

The alert isn't an issue when the image is inserted by an admin level users, since unfiltered_html will allow for that. Verified it does not alert when done by an author level account.

While it's an edgecase, it's a relatively easy bug to simply fix given its one line.

[wonderboymusic]

patch is exploding

[TobiasBg]

22135.2.diff​ is a refreshed patch that also uses wp_json_encode() for some extra sanity checks instead of the basic json_encode().

[wonderboymusic]

In 35677:

Media: in media_send_to_editor(), use wp_json_encode() instead of addslashes().

Props TobiasBg.
Fixes #22135.