Context Navigation

← Previous Ticket
Next Ticket →

#62885 closed enhancement (fixed)

Missing dot at the end of the descriptions

Reported by:	kapasias	Owned by:	SergeyBiryukov
Priority:	normal	Milestone:	6.8
Component:	General	Version:	6.9
Severity:	normal	Keywords:	has-patch
Cc:		Focuses:	docs

Description

In this file wp-includes/formatting.php
Added missing dots and improve function esc_attr( $text )
unsafe event handler attributes (like onclick, onmouseover, etc.) from HTML elements.

Attachments (1)

62885.diff (3.2 KB ) - added by kapasias 18 months ago.

Download all attachments as: .zip

Change History (9)

@kapasias
18 months ago

Attachment 62885.diff added

#1 @kapasias
18 months ago

Keywords has-patch added

Example

function custom_message_shortcode() {

	$value1 = 'onmouseover=alert("XSS")';
	$value2 = 'Text with Space';
	$value3 = 'abc = xyz';

    return '<div '.esc_html($value1).' '.esc_attr($value3).' class="custom-message">'.esc_attr($value2).'</div>';

}
add_shortcode('custom_message', 'custom_message_shortcode');

This line of code uses preg_replace() to sanitize a string by removing potentially unsafe event handler attributes (like onclick, onmouseover, etc.) from HTML elements.

This is a security measure to prevent malicious JavaScript from being executed via event handler attributes in user-supplied content. It helps mitigate risks like Cross-Site Scripting (XSS).

Before Update Function : https://prnt.sc/4LfxABLmaM2o

After Update Function : https://prnt.sc/ZYIWFxjYCDnN

so preg_replace( '/\s*on\w+\s*=\s*["\']?.*?["\']?/i', '', $safe_text ); line
sanitized and escaped html

Last edited 18 months ago by sabernhardt (previous) (diff)

#2 @swissspidy
18 months ago

Summary Missing dot at the end of the description and improve function → Missing dot at the end of the descriptions

Hi there,

You're really mixing two completely different things in this ticket — docblock improvements and changes to a crucial function.

Also, what you are missing is that esc_attr() is supposed to escape attribute values, not attribute names. So your example is wrong and thus the change doesn't make sense.

Let's focus on the docblock improvements :-)

#3 @kapasias
18 months ago

Focuses coding-standards removed

ok focus on docblock improvements

This ticket was mentioned in PR #8241 on WordPress/wordpress-develop by @ankitkumarshah.

18 months ago #4

Trac ticket: #62885

## Description
Implements the changes from this diff in accordance with this comment. Additionally, I have identified and corrected a few other instances in the file where periods were missing at the end of sentences.

## Changes:

Added missing periods to @return documentation blocks
Added missing periods to @param descriptions
Added missing periods to complete sentence inline comments
Added missing periods to section marker comments ("START: emoji arrays")

@ankitkumarshah commented on PR #8241:

18 months ago #5

Hi @peterwilsoncc,
I have made the necessary changes. Please review it at your convenience.
Thank You!

#6 @SergeyBiryukov
18 months ago

Owner set to SergeyBiryukov
Resolution → fixed
Status new → closed

In 59765:

Docs: Update comments in wp-includes/formatting.php per the documentation standards.

Follow-up to [1345], [8662], [8786], [33624], [34761].

Props kapasias, ankitkumarshah, swissspidy, peterwilsoncc.
Fixes #62885.

#7 @SergeyBiryukov
18 months ago

Milestone Awaiting Review → 6.8

@SergeyBiryukov commented on PR #8241:

18 months ago #8

Thanks for the PR! Merged in r59765.

Note: See TracTickets for help on using tickets.

Download in other formats:

Make WordPress Core

Context Navigation

#62885 closed enhancement (fixed)

Missing dot at the end of the descriptions

Description

Attachments (1)

Change History (9)

@kapasias 18 months ago

#1 @kapasias 18 months ago

#2 @swissspidy 18 months ago

#3 @kapasias 18 months ago

This ticket was mentioned in ​PR #8241 on ​WordPress/wordpress-develop by ​@ankitkumarshah. 18 months ago #4

​@ankitkumarshah commented on ​PR #8241: 18 months ago #5

#6 @SergeyBiryukov 18 months ago

#7 @SergeyBiryukov 18 months ago

​@SergeyBiryukov commented on ​PR #8241: 18 months ago #8