Add escape in walker nav menu title

[anonymized_13528887]

Escape walker nav menu title after applying filter

[mukesh27]

Hi @harshall, welcome to WordPress Trac! Thanks for the ticket.

i have check other instance of menu title but escape is not added in menu title.

[Hareesh Pillai]

This is a good check to add, as the filter response may return invalid output.

[welcher]

Adds late escaping

[welcher]

@harshall I've updated the patch against latest trunk and modified it to use late escaping as well.

It can probably do with some unit tests.

[SergeyBiryukov]

Historically, HTML is allowed in titles, see discussions in #4789, #14361, #22436.

Markup is allowed in post titles and it gets sanitized by KSES, meaning users without the unfiltered_html capability are limited to tags such as <strong>, <em>, and a few others.

If we do decide to reconsider this, there are multiple places where titles are not escaped, but at least Walker_Page should be updated for consistency.

[hellofromTonya]

I agree with @SergeyBiryukov that historically HTML is allowed in titles.

Fast forward 4 years, @welcher do you see a use case where the nav menu walker should not allow HTML with its title?

[welcher]

I don't see one, no. I'll mark as closed. Thanks for the follow up here.