the_block_template_skip_link() - XSS vulnerability - Apply FIX

[micromadness]

Dear people at WordPress,

I have already reported this problem on HackerOne, it has been reviewed by a member of the WordPress security team, and they asked me to publish the issue here.

Issue:

I would like to implement on my website the CSP (Content Security Policy): require-trusted-types-for ‘script’;

If I do it, I get the following error message in the browser Console:
“This document requires TrustedHTML assignment”
because “innerHTML” is used in this script: the_block_template_skip_link()

Impact
DOM XSS

FIX: in the script, replace "innerHTML" with "innerText" and the skiplink will still work.

I have done that on my own homepage:
remove_action( 'wp_footer', 'the_block_template_skip_link' );

and then I have added the skiplink again, replacing "innerHTML" with "innerText" in the script.

The code works (used theme: Twenty Twenty-Three).

[micromadness]

Alternative solution:

Use a policy which can create TrustedHTML.

This would allow all WordPress users to implement the Content Security Policy (CSP) require-trusted-types-for ‘script’;

also if they use scripts which need "innerHTML".

[sabernhardt]

switches innerHTML to innerText, adds to translator comment

[sabernhardt]

Hi and thanks for the report!

innerText would not work with HTML entities, but I did not find any in the 93 ​existing translations (see "Other locales" tab). The translator comment could let people know to avoid them for any future translations.

[johnbillion]

In 59831:

Security: Remove use of innerHTML in the the_block_template_skip_link() function.

There is no need to support HTML in this string and switching to innerText helps facilitate a more restrictive Content Security Policy.

Props micromadness, sabernhardt

Fixes #58765