WordPress.org

Make WordPress Core

Opened 15 years ago

Closed 15 years ago

Last modified 15 years ago

#3396 closed defect (bug) (fixed)

Plugin version, etc. not sanitized like description is

Reported by: Viper007Bond Owned by: markjaquith
Milestone: 2.1 Priority: lowest
Severity: minor Version: 2.1
Component: Administration Keywords: has-patch
Focuses: Cc:

Description

We sanitize plugin descriptions with kses, so why not the version and such?

Try this in a plugin for example:

Version: 1.0 <script type="text/javascript">alert('I haxz0red your PC!');</script>

Now of course plugin authors could just put bad JS into the plugin itself, so this isn't really a security ticket, more a "let's-do-the-same-thing-to-all-fields" ticket (either sanitize them all or none).

Attachments (1)

plugins.patch (1.4 KB) - added by Viper007Bond 15 years ago.

Download all attachments as: .zip

Change History (7)

#1 @markjaquith
15 years ago

  • Keywords needs-patch added
  • Owner changed from anonymous to markjaquith
  • Status changed from new to assigned

Agreed re: "all or nothing"

I'd go with "all," if only to stave off the inevitable "WordPress Security Bulletin: plugins can p0wn your WordPress!"

Patch it up!

#2 @Viper007Bond
15 years ago

Roger, captain!

#3 @Viper007Bond
15 years ago

  • Keywords has-patch added; needs-patch removed

#4 @markjaquith
15 years ago

  • Resolution set to fixed
  • Status changed from assigned to closed

(In [4540]) Sanitize all plugin metadata, for consistency. Props Viper007Bond. fixes #3396

#5 @markjaquith
15 years ago

Minor nitpicky note:

In the future, when using whitespace to align blocks of similar assignments (like the row of KSES calls), use spaces instead of tabs to make them line up. Many text editors can set tabs to be varying sizes, so they won't line up unless someone is using the same size tabs as you.

#6 @Viper007Bond
15 years ago

Well there is a quasi-standard, but good point. :)

Note: See TracTickets for help on using tickets.