Skip to content

Commit 4af6eb2

Browse files
mtashjianjr-godaddymtashjianjr-godaddy
authored
[WPEX-3724] Resolve XSS security vulnerability (#2612)
* Remove extraneous code * Implement wp_kses filtering on html output
1 parent 1d7e27f commit 4af6eb2

File tree

1 file changed

+129
-130
lines changed

1 file changed

+129
-130
lines changed

‎src/blocks/social-profiles/index.php‎

Lines changed: 129 additions & 130 deletions
Original file line numberDiff line numberDiff line change
@@ -14,167 +14,166 @@
1414
*/
1515
function coblocks_render_coblocks_social_profiles_block( $attributes ) {
1616

17-
global $post;
18-
19-
// Get the featured image.
20-
if ( has_post_thumbnail() ) {
21-
$thumbnail_id = get_post_thumbnail_id( $post->ID );
22-
$thumbnail = $thumbnail_id ? current( wp_get_attachment_image_src( $thumbnail_id, 'large', true ) ) : '';
23-
} else {
24-
$thumbnail = null;
25-
}
17+
// Supported social media platforms.
18+
$platforms = array(
19+
'facebook' => __( 'Facebook', 'coblocks' ),
20+
'twitter' => __( 'Twitter', 'coblocks' ),
21+
'instagram' => __( 'Instagram', 'coblocks' ),
22+
'tiktok' => __( 'TikTok', 'coblocks' ),
23+
'pinterest' => __( 'Pinterest', 'coblocks' ),
24+
'linkedin' => __( 'Linkedin', 'coblocks' ),
25+
'youtube' => __( 'YouTube', 'coblocks' ),
26+
'yelp' => __( 'Yelp', 'coblocks' ),
27+
'houzz' => __( 'Houzz', 'coblocks' ),
28+
);
2629

27-
// Attributes.
28-
$background_color_style = is_array( $attributes ) && isset( $attributes['customBlockBackgroundColor'] ) ? 'style=background-color:' . $attributes['customBlockBackgroundColor'] : '';
29-
$border_radius = is_array( $attributes ) && isset( $attributes['borderRadius'] ) ? "border-radius: {$attributes['borderRadius']}px;" : '';
30-
$has_padding = is_array( $attributes ) && isset( $attributes['padding'] ) ? 'has-padding' : '';
31-
$opens_in_new_tab = is_array( $attributes ) && isset( $attributes['opensInNewTab'] ) && $attributes['opensInNewTab'];
32-
33-
$has_background = '';
34-
$background_color_class = '';
35-
$custom_background_color = '';
36-
$has_color = '';
37-
$text_color_class = '';
38-
$custom_text_color = '';
39-
$icon_size = '';
40-
$padding = '';
41-
42-
if ( isset( $attributes['className'] ) && strpos( $attributes['className'], 'is-style-mask' ) !== false ) {
43-
$has_background = is_array( $attributes ) && isset( $attributes['hasColors'] ) && ( isset( $attributes['backgroundColor'] ) || isset( $attributes['customBackgroundColor'] ) ) && ( $attributes['hasColors'] || ( $attributes['backgroundColor'] || $attributes['customBackgroundColor'] ) ) ? 'has-text-color' : '';
44-
$background_color_class = is_array( $attributes ) && isset( $attributes['backgroundColor'] ) ? "has-{$attributes['backgroundColor']}-color" : false;
45-
$custom_background_color = is_array( $attributes ) && isset( $attributes['customBackgroundColor'] ) && isset( $attributes['hasColors'] ) && ( ! $attributes['hasColors'] && ! isset( $attributes['backgroundColor'] ) ) ? "color: {$attributes['customBackgroundColor']};" : '';
46-
} else {
47-
$has_background = is_array( $attributes ) && isset( $attributes['hasColors'] ) && ( isset( $attributes['backgroundColor'] ) || isset( $attributes['customBackgroundColor'] ) ) && ( $attributes['hasColors'] || ( isset( $attributes['backgroundColor'] ) || $attributes['customBackgroundColor'] ) ) ? 'has-background' : '';
48-
$background_color_class = is_array( $attributes ) && isset( $attributes['backgroundColor'] ) ? "has-{$attributes['backgroundColor']}-background-color" : false;
49-
$custom_background_color = is_array( $attributes ) && isset( $attributes['customBackgroundColor'] ) && isset( $attributes['hasColors'] ) && ( ! $attributes['hasColors'] && ! isset( $attributes['backgroundColor'] ) ) ? "background-color: {$attributes['customBackgroundColor']};" : '';
50-
51-
$has_color = is_array( $attributes ) && isset( $attributes['hasColors'] ) && ( isset( $attributes['textColor'] ) || isset( $attributes['customTextColor'] ) ) && ( $attributes['hasColors'] || ( isset( $attributes['textColor'] ) || $attributes['customTextColor'] ) ) ? 'has-text-color' : '';
52-
$text_color_class = is_array( $attributes ) && isset( $attributes['textColor'] ) ? "has-{$attributes['textColor']}-color" : false;
53-
$custom_text_color = is_array( $attributes ) && isset( $attributes['customTextColor'] ) && isset( $attributes['hasColors'] ) && ( ! $attributes['hasColors'] && ! isset( $attributes['textColor'] ) ) ? "color: {$attributes['customTextColor']};" : '';
54-
}
30+
$icons_markup = array();
5531

56-
if ( isset( $attributes['className'] ) && ( strpos( $attributes['className'], 'is-style-mask' ) !== false || strpos( $attributes['className'], 'is-style-circular' ) !== false ) ) {
57-
$icon_size = is_array( $attributes ) && isset( $attributes['iconSize'] ) ? "height:{$attributes['iconSize']}px;width: {$attributes['iconSize']}px;" : '';
58-
}
32+
foreach ( $platforms as $slug => $name ) {
33+
if ( empty( $attributes[ $slug ] ) ) {
34+
continue;
35+
}
5936

60-
if ( isset( $attributes['className'] ) && strpos( $attributes['className'], 'is-style-circular' ) !== false ) {
61-
$padding = is_array( $attributes ) && isset( $attributes['padding'] ) ? "padding:{$attributes['padding']}px;" : '';
62-
}
37+
$icon_wrapper_class = array( 'wp-block-button__link wp-block-coblocks-social__button wp-block-coblocks-social__button--' . $slug );
38+
$icon_wrapper_style = array();
6339

64-
// Supported social media platforms.
65-
$platforms = array(
40+
$has_classname = ! empty( $attributes['className'] );
6641

67-
'facebook' => array(
68-
'text' => esc_html__( 'Facebook', 'coblocks' ),
69-
'url' => $attributes['facebook'],
70-
),
71-
'twitter' => array(
72-
'text' => esc_html__( 'Twitter', 'coblocks' ),
73-
'url' => $attributes['twitter'],
74-
),
75-
'instagram' => array(
76-
'text' => esc_html__( 'Instagram', 'coblocks' ),
77-
'url' => $attributes['instagram'],
78-
),
79-
'tiktok' => array(
80-
'text' => esc_html__( 'TikTok', 'coblocks' ),
81-
'url' => $attributes['tiktok'],
82-
),
83-
'pinterest' => array(
84-
'text' => esc_html__( 'Pinterest', 'coblocks' ),
85-
'url' => $attributes['pinterest'],
86-
),
87-
'linkedin' => array(
88-
'text' => esc_html__( 'Linkedin', 'coblocks' ),
89-
'url' => $attributes['linkedin'],
90-
),
42+
$has_style_mask = $has_classname && strpos( $attributes['className'], 'is-style-mask' ) !== false;
43+
$has_style_circular = $has_classname && strpos( $attributes['className'], 'is-style-circular' ) !== false;
9144

92-
'youtube' => array(
93-
'text' => esc_html__( 'YouTube', 'coblocks' ),
94-
'url' => $attributes['youtube'],
95-
),
96-
'yelp' => array(
97-
'text' => esc_html__( 'Yelp', 'coblocks' ),
98-
'url' => $attributes['yelp'],
99-
),
100-
'houzz' => array(
101-
'text' => esc_html__( 'Houzz', 'coblocks' ),
102-
'url' => $attributes['houzz'],
103-
),
104-
);
45+
if ( isset( $attributes['backgroundColor'] ) || isset( $attributes['customBackgroundColor'] ) ) {
46+
$icon_wrapper_class[] = $has_style_mask
47+
? 'has-' . $attributes['backgroundColor'] . '-color'
48+
: 'has-' . $attributes['backgroundColor'] . '-background-color';
49+
50+
if ( isset( $attributes['customBackgroundColor'] ) ) {
51+
$icon_wrapper_style[] = $has_style_mask
52+
? 'color:' . $attributes['customBackgroundColor'] . ';'
53+
: 'background-color:' . $attributes['customBackgroundColor'] . ';';
54+
}
55+
}
56+
57+
if ( isset( $attributes['textColor'] ) || isset( $attributes['customTextColor'] ) ) {
58+
$icon_wrapper_class[] = 'has-text-color';
59+
$icon_wrapper_class[] = 'has-' . $attributes['textColor'] . '-color';
60+
61+
if ( isset( $attributes['customTextColor'] ) ) {
62+
$icon_wrapper_style[] = 'color:' . $attributes['customTextColor'] . ';';
63+
}
64+
}
65+
66+
$icon_size_css = '';
67+
if ( $has_style_mask || $has_style_circular ) {
68+
$icon_size_css = 'height:' . $attributes['iconSize'] . 'px; width:' . $attributes['iconSize'] . 'px;';
69+
}
70+
71+
if ( $has_style_circular ) {
72+
$icon_wrapper_style[] = 'padding:' . $attributes['padding'] . 'px;';
73+
}
74+
75+
if ( ! empty( $attributes['borderRadius'] ) ) {
76+
$icon_wrapper_style[] = 'border-radius:' . $attributes['borderRadius'] . 'px;';
77+
}
10578

106-
// Start markup.
107-
$markup = '';
108-
109-
// Set the social link target.
110-
$link_target = $opens_in_new_tab ? 'target="_blank" rel="noopener noreferrer"' : '';
111-
112-
foreach ( $platforms as $id => $platform ) {
113-
114-
if ( isset( $attributes[ $id ] ) && $attributes[ $id ] ) {
115-
$markup .= sprintf(
116-
'<li>
117-
<a href="%1$s" class="wp-block-button__link wp-block-coblocks-social__button wp-block-coblocks-social__button--%8$s %3$s %7$s %9$s %10$s %13$s" title="%2$s" style="%4$s%6$s%11$s%12$s" %14$s>
118-
<span class="wp-block-coblocks-social__icon" style="%5$s"></span>
119-
<span class="wp-block-coblocks-social__text">%2$s</span>
120-
</a>
121-
</li>',
122-
esc_url( $platform['url'] ),
123-
esc_html( $platform['text'] ),
124-
esc_attr( $has_background ),
125-
esc_attr( $border_radius ),
126-
esc_attr( $icon_size ),
127-
esc_attr( $custom_background_color ),
128-
esc_attr( $background_color_class ),
129-
esc_attr( $id ),
130-
esc_attr( $has_color ),
131-
esc_attr( $text_color_class ),
132-
esc_attr( $custom_text_color ),
133-
esc_attr( $padding ),
134-
esc_attr( $has_padding ),
135-
$link_target
136-
);
79+
if ( ! empty( $attributes['padding'] ) ) {
80+
$icon_wrapper_class[] = 'has-padding';
13781
}
82+
83+
$icon_wrapper_open = wp_kses(
84+
sprintf(
85+
'<li><a href="%s" title="%s" class="%s" style="%s"%s>',
86+
esc_url( $attributes[ $slug ] ),
87+
esc_html( $name ),
88+
esc_attr( implode( ' ', $icon_wrapper_class ) ),
89+
esc_attr( implode( '', $icon_wrapper_style ) ),
90+
empty( $attributes['opensInNewTab'] ) ? '' : ' target="_blank" rel="noopener noreferrer"'
91+
),
92+
array(
93+
'li' => array(),
94+
'a' => array(
95+
'class' => true,
96+
'href' => true,
97+
'rel' => true,
98+
'style' => true,
99+
'target' => true,
100+
'title' => true,
101+
),
102+
)
103+
);
104+
105+
$icon_wrapper_close = '</a></li>';
106+
107+
$icon_inner_markup = wp_kses(
108+
sprintf(
109+
'<span class="wp-block-coblocks-social__icon" style="%s"></span><span class="wp-block-coblocks-social__text">%s</span>',
110+
esc_attr( $icon_size_css ),
111+
esc_html( $name )
112+
),
113+
array(
114+
'span' => array(
115+
'class' => true,
116+
'style' => true,
117+
),
118+
)
119+
);
120+
121+
$icons_markup[] = $icon_wrapper_open . $icon_inner_markup . $icon_wrapper_close;
138122
}
139123

140-
// Build classes.
141-
$class = 'wp-block-coblocks-social wp-block-coblocks-social-profiles';
124+
// Block wrapper.
125+
$block_wrapper_class = array( 'wp-block-coblocks-social wp-block-coblocks-social-profiles' );
142126

143127
if ( isset( $attributes['className'] ) ) {
144-
$class .= ' ' . $attributes['className'];
128+
$block_wrapper_class[] = $attributes['className'];
145129
}
146130

147131
if ( isset( $attributes['align'] ) ) {
148-
$class .= ' align' . $attributes['align'];
132+
$block_wrapper_class[] = 'align' . $attributes['align'];
149133
}
150134

151135
if ( isset( $attributes['textAlign'] ) ) {
152-
$class .= " has-text-align-{$attributes['textAlign']}";
136+
$block_wrapper_class[] = 'has-text-align-' . $attributes['textAlign'];
153137
}
154138

155139
if ( isset( $attributes['blockBackgroundColor'] ) || isset( $attributes['customBlockBackgroundColor'] ) ) {
156-
$class .= ' has-background';
140+
$block_wrapper_class[] = 'has-background';
157141
}
158142

159143
if ( isset( $attributes['blockBackgroundColor'] ) ) {
160-
$class .= " has-{$attributes['blockBackgroundColor']}-background-color";
144+
$block_wrapper_class[] = 'has-' . $attributes['blockBackgroundColor'] . '-background-color';
161145
}
162146

163-
if ( isset( $attributes['hasColors'] ) && $attributes['hasColors'] ) {
164-
$class .= ' has-colors';
147+
if ( ! empty( $attributes['hasColors'] ) ) {
148+
$block_wrapper_class[] = 'has-colors';
165149
}
166150

167151
if ( isset( $attributes['size'] ) && ( isset( $attributes['className'] ) && strpos( $attributes['className'], 'is-style-mask' ) === false ) ) {
168-
$class .= ' has-button-size-' . $attributes['size'];
152+
$block_wrapper_class[] = 'has-button-size-' . $attributes['size'];
169153
}
170154

171-
// Render block content.
172-
$block_content = sprintf(
173-
'<div class="%1$s" %2$s><ul>%3$s</ul></div>',
174-
esc_attr( $class ),
175-
esc_attr( $background_color_style ),
176-
$markup
155+
$block_wrapper_style = array();
156+
157+
if ( isset( $attributes['customBlockBackgroundColor'] ) ) {
158+
$block_wrapper_style[] = 'background-color:' . $attributes['customBlockBackgroundColor'] . ';';
159+
}
160+
161+
$block_wrapper_open = wp_kses(
162+
sprintf(
163+
'<div class="%s" style="%s"><ul>',
164+
esc_attr( implode( ' ', $block_wrapper_class ) ),
165+
esc_attr( implode( '', $block_wrapper_style ) )
166+
),
167+
array(
168+
'div' => array(
169+
'class' => true,
170+
'style' => true,
171+
),
172+
'ul' => array(),
173+
)
177174
);
178175

179-
return $block_content;
176+
$block_wrapper_close = '</ul></div>';
177+
178+
return $block_wrapper_open . implode( '', $icons_markup ) . $block_wrapper_close;
180179
}

0 commit comments

Comments
 (0)