Opened 8 years ago
Closed 7 years ago
#40635 closed enhancement (fixed)
Move JavaScript `sanitizeText` and `stripTags` functions from press-this to core
Reported by: |
|
Owned by: |
|
---|---|---|---|
Milestone: | 4.9 | Priority: | normal |
Severity: | normal | Version: | |
Component: | Security | Keywords: | has-patch needs-unit-tests 2nd-opinion |
Focuses: | javascript | Cc: |
Description
The file press-this.js
includes two generally useful helper functions:
stripTags
strips HTML tags from a string using a series of regex replace calls.sanitizeText
strips HTML tags and converts HTML entities in a string. It leverages a textarea's content to encode HTML and returns a string that is safe to evaluate.
These functions would be generally useful in core and for plugin and theme developers and could be added to the wp
namespace, eg wp.utils.stripTags
and wp.utils.sanitizeText
Attachments (4)
Change History (15)
This ticket was mentioned in Slack in #core by adamsilverstein. View the logs.
8 years ago
#4
@
8 years ago
- separate out functionality into its own file,
wp-sanitize.js
- use a separate namespace as suggested in chat -
wp.sanitize
#5
@
8 years ago
- Owner set to adamsilverstein
- Resolution set to fixed
- Status changed from new to closed
In 41061:
#7
follow-up:
↓ 9
@
7 years ago
- Component changed from General to Security
- Keywords 2nd-opinion added
- Resolution fixed deleted
- Status changed from closed to reopened
wp.sanitize.sanitizeText()
looks weird since it's repetitive. What about wp.sanitize.text()
?
This ticket was mentioned in Slack in #core by jeffpaul. View the logs.
7 years ago
#9
in reply to:
↑ 7
@
7 years ago
Replying to ocean90:
wp.sanitize.sanitizeText()
looks weird since it's repetitive. What aboutwp.sanitize.text()
?
@ocean90 What do you think of something more descriptive here like wp.sanitize.stripTagsAndEncode
? This function strips tags from a string and also encodes any HTML entities.
cc: @kraftbj if we change the function name, the Press This
plugin will need an update.
40635.diff moves the
sanitizeText
andstripTags
functions fromwp-admin/js/press-this.js
towp-includes/js/utils.js
and namespaces them aswp.utils.sanitizeText
andwp.utils.stripTags
.Some unit tests for these helpers would be a great addition, if we have them I couldn't find them.