Missing escaping for XML error message

[maheshpatel]

• File: ​src/wp-trackback.php
• Line: 37
• Problem: $error_message output in XML without escaping

Current Code:

  if ( $error ) {
      echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
      echo "<response>\n";
      echo "<error>1</error>\n";
      echo "<message>$error_message</message>\n";
      echo '</response>';
  }

Fix:

  if ( $error ) {
      echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
      echo "<response>\n";
      echo "<error>1</error>\n";
      echo "<message>" . esc_html ( $error_message ) . "</message>\n";
      echo '</response>';
  }

Why It Matters:

• XML special characters (&, <, >) can break XML parsing
• Error messages come from user actions or system states

Add escaping [src/wp-trackback.php#L37 src/wp-trackback.php]

if ( $error ) {

echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
echo "<response>\n";
echo "<error>1</error>\n";
echo "<message>" . esc_html ( $error_message ) . "</message>\n";
echo '</response>';

}

[maheshpatel]

This issue has been resolved and generated PR
PR - ​https://github.com/WordPress/wordpress-develop/pull/11527

[sabernhardt]

The trackback_response() function has been available since changeset 8, and the escaping functions were added later.

Would esc_xml() be a better choice?

I would say that this warrants adding a unit test, but it doesn't seem there are any unit tests for the functionality in wp-trackback.php.

I would say that this warrants adding a unit test, but it doesn't seem there are any unit tests for the functionality in wp-trackback.php.

Agreed...wish I had time to work on that ;-(

Here's some info for whoever does write unit tests:

• the main diff between esc_html() and esc_xml() is that esc_xml() leaves ​CDATA Sections intact. That is, if the $error_message contained something like <![CDATA[<greeting>Hello, world!</greeting>]]>, esc_html() would replace the < and > chars with < and >, whereas esc_xml() won't.
• so, it'd be good if the unit tests included $error_message's with and without CDATA Sections

I don't consider tests to be a blocker here.

[SergeyBiryukov]

In 62414:

Pings/Trackbacks: Escape the XML error message in trackback_response().

Props maheshpatel, pbiron, sabernhardt, westonruter, SergeyBiryukov.
Fixes #65047.