wp_kses_post incorrectly escapes "<" attributes values

[jernstjernst]

Hello,

We are trying to use wp_kses everywhere we output as recommended. However, we encountered the following issue: 

Example:

<?php
echo wp_kses_post('<button data-glide-dir="<">&lt;</button>")
?>

Expected result:

<button data-glide-dir="<">&lt;</button>

Actual result: 

&lt;button data-glide-dir=&quot;&lt;</button>

This breaks glide.js unless we use this workaround (​https://github.com/glidejs/glide/issues/547)

I think this should be allowed as per ​https://html.spec.whatwg.org/multipage/syntax.html#syntax-attributes

Thanks and best regards

[jernstjernst]

Sorry, the test case should read:

<?php
echo wp_kses_post('<button data-glide-dir="<">&lt;</button>')
?>

[jonsurrell]

This is certainly incorrect behavior and the HTML you shared is indeed fine. The fundamental problem is that kses, as a system, doesn't really understand HTML.

There are efforts to improve things with the ​HTML API, but it's not entirely ready to replace everything kses does yet.

I'd suggest encoding the attribute value as a workaround, kses shouldn't have a problem understanding this HTML:

<?php
wp_kses_post('<button data-glide-dir="&lt;">&lt;</button>');
// returns '<button data-glide-dir=\"&lt;\">&lt;</button>'

[jonsurrell]

​Here's a demo of the behavior.

I've confirmed this behavior as of version 6.3, but I suspect it's been around much longer. I'll set the version arbitrarily to 5.0.