Skip to content

Commit 1b6ce9e

Browse files
audrasjbaudrasjb
committed
Grouped Backports to the 6.4 branch.
- Editor: Fix Path Traversal issue on Windows in Template-Part Block. - Editor: Sanitize Template Part HTML tag on save. - HTML API: Run URL attributes through `esc_url()`. Merges [58470], [58471], [58472] and [58473] to the 6.4 branch. Props xknown, peterwilsoncc, jorbin, bernhard-reiter, azaozz, dmsnell, gziolo. git-svn-id: https://develop.svn.wordpress.org/branches/6.4@58475 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 96a5188 commit 1b6ce9e

File tree

6 files changed

+103
-64
lines changed

6 files changed

+103
-64
lines changed

‎package-lock.json‎

Lines changed: 52 additions & 52 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -85,26 +85,26 @@
8585
"@wordpress/api-fetch": "6.39.13",
8686
"@wordpress/autop": "3.42.13",
8787
"@wordpress/blob": "3.42.13",
88-
"@wordpress/block-directory": "4.19.17",
88+
"@wordpress/block-directory": "4.19.18",
8989
"@wordpress/block-editor": "12.10.14",
90-
"@wordpress/block-library": "8.19.17",
90+
"@wordpress/block-library": "8.19.18",
9191
"@wordpress/block-serialization-default-parser": "4.42.13",
9292
"@wordpress/blocks": "12.19.13",
9393
"@wordpress/commands": "0.13.14",
9494
"@wordpress/components": "25.8.14",
9595
"@wordpress/compose": "6.19.13",
9696
"@wordpress/core-commands": "0.11.14",
9797
"@wordpress/core-data": "6.19.14",
98-
"@wordpress/customize-widgets": "4.19.17",
98+
"@wordpress/customize-widgets": "4.19.18",
9999
"@wordpress/data": "9.12.13",
100100
"@wordpress/data-controls": "3.11.13",
101101
"@wordpress/date": "4.42.13",
102102
"@wordpress/deprecated": "3.42.13",
103103
"@wordpress/dom": "3.42.13",
104104
"@wordpress/dom-ready": "3.42.13",
105-
"@wordpress/edit-post": "7.19.17",
106-
"@wordpress/edit-site": "5.19.17",
107-
"@wordpress/edit-widgets": "5.19.17",
105+
"@wordpress/edit-post": "7.19.18",
106+
"@wordpress/edit-site": "5.19.18",
107+
"@wordpress/edit-widgets": "5.19.18",
108108
"@wordpress/editor": "13.19.14",
109109
"@wordpress/element": "5.19.13",
110110
"@wordpress/escape-html": "2.42.13",

‎src/wp-includes/blocks.php‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1226,7 +1226,7 @@ function _filter_block_content_callback( $matches ) {
12261226
* @return array The filtered and sanitized block object result.
12271227
*/
12281228
function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() ) {
1229-
$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols );
1229+
$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols, $block );
12301230

12311231
if ( is_array( $block['innerBlocks'] ) ) {
12321232
foreach ( $block['innerBlocks'] as $i => $inner_block ) {
@@ -1242,20 +1242,26 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array()
12421242
* non-allowable HTML.
12431243
*
12441244
* @since 5.3.1
1245+
* @since 6.5.5 Added the `$block_context` parameter.
12451246
*
12461247
* @param string[]|string $value The attribute value to filter.
12471248
* @param array[]|string $allowed_html An array of allowed HTML elements and attributes,
12481249
* or a context name such as 'post'. See wp_kses_allowed_html()
12491250
* for the list of accepted context names.
12501251
* @param string[] $allowed_protocols Optional. Array of allowed URL protocols.
12511252
* Defaults to the result of wp_allowed_protocols().
1253+
* @param array $block_context Optional. The block the attribute belongs to, in parsed block array format.
12521254
* @return string[]|string The filtered and sanitized result.
12531255
*/
1254-
function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array() ) {
1256+
function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array(), $block_context = null ) {
12551257
if ( is_array( $value ) ) {
12561258
foreach ( $value as $key => $inner_value ) {
1257-
$filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols );
1258-
$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols );
1259+
$filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols, $block_context );
1260+
$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols, $block_context );
1261+
1262+
if ( isset( $block_context['blockName'] ) && 'core/template-part' === $block_context['blockName'] ) {
1263+
$filtered_value = filter_block_core_template_part_attributes( $filtered_value, $filtered_key, $allowed_html );
1264+
}
12591265

12601266
if ( $filtered_key !== $key ) {
12611267
unset( $value[ $key ] );
@@ -1270,6 +1276,28 @@ function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = ar
12701276
return $value;
12711277
}
12721278

1279+
/**
1280+
* Sanitizes the value of the Template Part block's `tagName` attribute.
1281+
*
1282+
* @since 6.5.5
1283+
*
1284+
* @param string $attribute_value The attribute value to filter.
1285+
* @param string $attribute_name The attribute name.
1286+
* @param array[]|string $allowed_html An array of allowed HTML elements and attributes,
1287+
* or a context name such as 'post'. See wp_kses_allowed_html()
1288+
* for the list of accepted context names.
1289+
* @return string The sanitized attribute value.
1290+
*/
1291+
function filter_block_core_template_part_attributes( $attribute_value, $attribute_name, $allowed_html ) {
1292+
if ( empty( $attribute_value ) || 'tagName' !== $attribute_name ) {
1293+
return $attribute_value;
1294+
}
1295+
if ( ! is_array( $allowed_html ) ) {
1296+
$allowed_html = wp_kses_allowed_html( $allowed_html );
1297+
}
1298+
return isset( $allowed_html[ $attribute_value ] ) ? $attribute_value : '';
1299+
}
1300+
12731301
/**
12741302
* Parses blocks out of a content string, and renders those appropriate for the excerpt.
12751303
*

‎src/wp-includes/formatting.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4802,12 +4802,13 @@ static function ( $matches ) {
48024802
* Escapes an HTML tag name.
48034803
*
48044804
* @since 2.5.0
4805+
* @since 6.5.5 Allow hyphens in tag names (i.e. custom elements).
48054806
*
48064807
* @param string $tag_name
48074808
* @return string
48084809
*/
48094810
function tag_escape( $tag_name ) {
4810-
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9_:]/', '', $tag_name ) );
4811+
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9-_:]/', '', $tag_name ) );
48114812
/**
48124813
* Filters a string cleaned and escaped for output as an HTML tag.
48134814
*

‎src/wp-includes/functions.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6145,6 +6145,9 @@ function validate_file( $file, $allowed_files = array() ) {
61456145
return 0;
61466146
}
61476147

6148+
// Normalize path for Windows servers
6149+
$file = wp_normalize_path( $file );
6150+
61486151
// `../` on its own is not allowed:
61496152
if ( '../' === $file ) {
61506153
return 1;

‎src/wp-includes/html-api/class-wp-html-tag-processor.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2071,7 +2071,14 @@ public function set_attribute( $name, $value ) {
20712071
if ( true === $value ) {
20722072
$updated_attribute = $name;
20732073
} else {
2074-
$escaped_new_value = esc_attr( $value );
2074+
$comparable_name = strtolower( $name );
2075+
2076+
/*
2077+
* Escape URL attributes.
2078+
*
2079+
* @see https://html.spec.whatwg.org/#attributes-3
2080+
*/
2081+
$escaped_new_value = in_array( $comparable_name, wp_kses_uri_attributes() ) ? esc_url( $value ) : esc_attr( $value );
20752082
$updated_attribute = "{$name}=\"{$escaped_new_value}\"";
20762083
}
20772084

0 commit comments

Comments
 (0)