Cover: Ensure url is not malformed due to sanitization through wp_kses
#47906
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ation through `wp_kses`
ntsekouras
added
[Type] Bug
ntsekouras
requested review from
mcsf,
youknowriad,
richtabor,
jorgefilipecosta and
annezazu
|
Size Change: +35 B (0%) Total Size: 1.32 MB
ℹ️ View Unchanged
|
ntsekouras
added
the
Backport to WP 6.7 Beta/RC
|
@ntsekouras, does this only affect the Cover block or any media block that stores the URL in the attribute? If the latter, we should consider a more general solution to the problem. |
From what I could see it's only about the Cover block because other media blocks use the |
Mamaduka
approved these changes
Feb 9, 2023
mcsf
approved these changes
Feb 9, 2023
ntsekouras
added a commit
that referenced
this pull request
Feb 13, 2023
…ation through `wp_kses` (#47906)
|
I just cherry-picked this PR to the wp/6.2 branch to get it included in the next release: 1af9f34 |
ntsekouras
removed
the
Backport to WP 6.7 Beta/RC
DaisyOlsen
changed the title
url is not malformed due to sanitization through wp_ksesurl is not malformed due to sanitization through wp_kses
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What?
Resolves: #47636
Why?
The issue here is a result of GB sanitizing the pattern content through
wp_kses_post. The flow there is:wp_kses_normalize_entitiesreplaces&to&wp_pre_kses_block_attributesreplaces&to\u0026that results in\u0026amp;in the final output.The above though is for security reasons and normally is not an issue for block attributes that are not URLs. In the
Coverblock case though it is a problem, as it results to a malformed URL. I'm not confident following a similar approach to PD to replace
\u0026amp;to&, but maybe ensuring that the url is not malformed insideCoverblock might be enough and safe.Testing Instructions
&), fetch the images properly. You can check theheaderspattern category.