Exception to escapement: Exported or imported data

[anrghg]

JSON data echoed for download as in ​https://plugins.trac.wordpress.org/browser/anrghg/tags/1.3.1/admin/includes/export.php?rev=2749921#L327 cannot be escaped using wp_kses(). I’m opening this ticket for documentation purposes.

wp_kses() calls wp_kses_split(), that calls _wp_kses_split_callback(), that calls wp_kses_split2() (​https://docs.classicpress.net/reference/functions/_wp_kses_split_callback/). And the first thing wp_kses_split2() does is to “fix” the data by calling wp_kses_stripslashes(), that strips backslashes from in front of double quotes (​https://docs.classicpress.net/reference/functions/wp_kses_split2/ and ​https://developer.wordpress.org/reference/functions/wp_kses_stripslashes/) and thus breaks JSON.

Anyway, cxported data is expected to truly mirror the existing data, so there seems to be no way to escape anything here when echoing for download.

The same holds true when importing data as in ​https://plugins.trac.wordpress.org/browser/anrghg/tags/1.3.1/admin/includes/import.php?rev=2749921#L362

For PHPCS, such instances need to be whitelisted and I’m held accountable for linking to relevant documentation acknowledging the exceptions.

[dmsnell]

There seem to be at least two conflated problems here:

• exports should retain equivalent content as is stored in the database
• wp_kses() corrupts data through its call to wp_kses_stripslashes().

#63881 proposed deprecating that function anyhow, and the refactor of wp_kses() in #66208 avoids this entire call-chain by replacing the parsing implementation.

@anrghg if you are still around, would you be willing to clarify on what specifically is the issue? if it’s the corruption, perhaps this is resolved when #66208 merges.