security: escape output in admin interfaces #181
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Applies output escaping to translation functions used in HTML contexts: - Uses esc_html__() and esc_html_e() for text output - Uses esc_attr_e() for HTML attribute values - Fixes text domain from 'syndication' to 'push-syndication' - Escapes wp_die() message Supersedes #121 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>
Addresses all outstanding WordPress.Security.EscapeOutput violations across six core plugin files to strengthen output sanitisation and prevent potential XSS vulnerabilities. These fixes complete the security hardening efforts for the 2.2.0 release by ensuring all user-facing output is properly escaped according to WordPress coding standards. Changes include replacing legacy escaping patterns with WordPress core functions, adding appropriate escaping to previously missed outputs, and documenting intentionally safe outputs with inline PHPCS exceptions where applicable.
Closed
GaryJones
added
the
type: maintenance
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR completes the security hardening for version 2.2.0 by addressing all PHPCS WordPress.Security.EscapeOutput warnings across the plugin's admin interfaces.
Problem
The codebase contained multiple instances where translated strings and dynamic content were output directly to HTML without proper escaping. This created potential XSS vulnerabilities where user-controlled or external data could be rendered without sanitisation. The PHPCS WordPress.Security.EscapeOutput sniff flagged these security concerns across seven core files.
This issue was particularly prevalent in:
esc_url()wrapperesc_attr()protectionesc_html()Solution
The changes systematically address each security concern whilst maintaining functionality and preserving intended HTML markup in translations:
Translation Function Replacements
__()withesc_html__()in printf/echo statements for plain text translationswp_kses()with appropriate allowed tags for translations containing intentional HTML markupURL and Attribute Escaping
esc_url()wrappers for all URL outputs includingadmin_url(),get_delete_post_link(), andadd_query_arg()callsesc_attr()for all form input values and HTML attributesDynamic Content Protection
esc_html()for exception messages and dynamic text outputFiles Modified
includes/class-syndication-admin-notices.php- Enhanced notice rendering with proper HTML escapingincludes/class-syndication-client-factory.php- Fixed text domain and added URL escapingincludes/class-syndication-logger-viewer.php- Added attribute and URL escaping for form elementsincludes/class-syndication-wp-rest-client.php- Escaped exception messagesincludes/class-syndication-wp-xml-client.php- Applied comprehensive escaping to admin interface outputincludes/class-syndication-wp-xmlrpc-client.php- Escaped URLs and dynamic content in admin displaysincludes/class-wp-push-syndication-server.php- Added escaping throughout settings interfacesThis PR supersedes #121, which encountered complex merge conflicts with the develop branch.