Privacy: Escape the comment link output in the wp_comments_personal_data_exporter() function.

[birgire]

In the wp_comments_personal_data_exporter() function we have (​src):

$value = get_comment_link( $comment->comment_ID );
$value = '<a href="' . $value . '" target="_blank" rel="noreferrer noopener">' . $value . '</a>';

but it looks like the escaping is missing here.

Also the output of get_comment_link() is filterable and not escaped.

We could consider instead:

$value = get_comment_link( $comment->comment_ID );
$value = sprintf( 
    '<a href="%1$s" target="_blank" rel="noreferrer noopener">%2$s</a>',
    esc_url( $value ),
    esc_html( $value )
);

[birgire]

44054.diff​ adds escaping as described above.

[iandunn]

Thanks for catching that!

At first glance, I don't see any way for an attacker to introduce malicious input to that URL (unless a plugin is filtering it and introduces some). Even if there were a way, the malicious script would execute in the context of localhost on the target's computer, rather than the site it was exported from, which I think would mitigate a lot of the damage it could do.

We should definitely still fix it, though.

In the future, it's best to ​report any security issues to HackerOne, even if they're only present in trunk or a beta/RC. There are some high-profile sites that run trunk or the latest branch in production.

[iandunn]

In 43245:

Privacy: Escape comment URLs in personal export file to prevent XSS.

There doesn't appear to be any way for an attacker to introduce malicious input into the URL, unless a plugin is filtering the URL to add it, but it's better to be safe than sorry.

Props birgire.
Fixes #44054.

[iandunn]

Reopening for 4.9 backport consideration.

[birgire]

@iandunn thanks for the heads-up, I actually didn't consider this a real security issue when I posted, but I will keep that in mind.

[azaozz]

+1 for merging to 4.9.6.

[azaozz]

In 43270:

Privacy: Escape comment URLs in personal export file to prevent XSS.

There doesn't appear to be any way for an attacker to introduce malicious input into the URL, unless a plugin is filtering the URL to add it, but it's better to be safe than sorry.

Props birgire.
Merges [43245] to the 4.9 branch.
Fixes #44054.

[desrosj]

Moving to the new Privacy component.