Need escaping in class-wp-rest-widget-types-controller file

[priyankkpatel]

in /wp-includes/rest-api/endpoints/class/class-wp-rest-widget-types-controller.php file, need escaping on function render_legacy_widget_preview_iframe.
Attaching patch for the same.

[TimothyBlynJacobs]

Hi @priyankkpatel,

Why should these values be escaped?

[priyankkpatel]

Hi, @TimothyBlynJacobs ,

I think since it's a request parameter from the function itself we can escape these values while calling.

[TimothyBlynJacobs]

WordPress practices late escaping. In other words, unsafe values should be escaped as close to their output as possible. Preemptively escaping every value that is passed to a function would be unnecessary and can sometimes lead to security issues itself.

Instead, you'd need to look at the function being called, render_block_core_legacy_widget and evaluate if there were any places where output was generated without being properly escaped.