Exporter does not escape url

[gslin]

In wp-admin/includes/export.php, url does not escape correctly:

<wp:comment_author_url><?php echo $c->comment_author_url; ?></wp:comment_author_url>

htmlspecialchars() will escape only 4 chars when no options given (lt, gt, amp, quot), and these 4 chars are compatible to XML, so we can use htmlspecialchars() to fix the bug:

<wp:comment_author_url><?php echo htmlspecialchars($c->comment_author_url); ?></wp:comment_author_url>

[mtekk]

Made patch implementing gslin's suggestion.

[Denis-de-Bernardy]

use clean_url() instead

[westi]

clean_url looks like a better solution here.

However, it would be good to have an example of the actual url that was causing an issue to make sure that we have fixed the problem.

Removing commit for now while we get reporter feedback

[Denis-de-Bernardy]

I can only imagine it's a url from an old blog, that didn't go through the sanitizer when it was inserted. The clean_url() won't hurt either way.

[ryan]

clean_url() will escape ampersands by default. I don't think the importer handles that.

[Denis-de-Bernardy]

Punting per IRC discussion.

[Denis-de-Bernardy]

see also: #7652, #10147

[markjaquith]

esc_url_raw() is what you want — sanitizes without ampersand-entity-encoding.

[markjaquith]

(In [12359]) Use esc_url_raw() on wp:comment_author_url in exports. fixes #9524