Grouped Backports to the 6.1 branch.

- Editor: Fix Path Traversal issue on Windows in Template-Part Block.
- Editor: Sanitize Template Part HTML tag on save.
- HTML API: Run URL attributes through `esc_url()`.

Merges [58470], [58471], [58472] and [58473] to the 6.1 branch.
Props xknown, peterwilsoncc, jorbin, bernhard-reiter, azaozz, dmsnell, gziolo.




git-svn-id: https://develop.svn.wordpress.org/branches/6.1@58480 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jb Audras 2024-06-24 15:15:02 +00:00
parent bce44bbfe1
commit b4e86a5c8c
7 changed files with 1507 additions and 1199 deletions

2648
package-lock.json generated

File diff suppressed because it is too large Load Diff

@ -81,24 +81,24 @@
"@wordpress/api-fetch": "6.14.1",
"@wordpress/autop": "3.17.1",
"@wordpress/blob": "3.17.1",
"@wordpress/block-directory": "3.15.14",
"@wordpress/block-directory": "3.15.15",
"@wordpress/block-editor": "10.0.10",
"@wordpress/block-library": "7.14.14",
"@wordpress/block-library": "7.14.15",
"@wordpress/block-serialization-default-parser": "4.17.1",
"@wordpress/blocks": "11.16.4",
"@wordpress/components": "21.0.7",
"@wordpress/compose": "5.15.2",
"@wordpress/core-data": "5.0.4",
"@wordpress/customize-widgets": "3.14.14",
"@wordpress/customize-widgets": "3.14.15",
"@wordpress/data": "7.1.3",
"@wordpress/data-controls": "2.17.3",
"@wordpress/date": "4.17.1",
"@wordpress/deprecated": "3.17.1",
"@wordpress/dom": "3.17.2",
"@wordpress/dom-ready": "3.17.1",
"@wordpress/edit-post": "6.14.14",
"@wordpress/edit-site": "4.14.16",
"@wordpress/edit-widgets": "4.14.14",
"@wordpress/edit-post": "6.14.15",
"@wordpress/edit-site": "4.14.17",
"@wordpress/edit-widgets": "4.14.15",
"@wordpress/editor": "12.16.10",
"@wordpress/element": "4.15.1",
"@wordpress/escape-html": "2.17.1",

File diff suppressed because one or more lines are too long

@ -835,7 +835,7 @@ function _filter_block_content_callback( $matches ) {
* @return array The filtered and sanitized block object result.
*/
function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() ) {
$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols );
$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols, $block );
if ( is_array( $block['innerBlocks'] ) ) {
foreach ( $block['innerBlocks'] as $i => $inner_block ) {
@ -851,6 +851,7 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array()
* non-allowable HTML.
*
* @since 5.3.1
* @since 6.5.5 Added the `$block_context` parameter.
*
* @param string[]|string $value The attribute value to filter.
* @param array[]|string $allowed_html An array of allowed HTML elements and attributes,
@ -858,13 +859,18 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array()
* for the list of accepted context names.
* @param string[] $allowed_protocols Optional. Array of allowed URL protocols.
* Defaults to the result of wp_allowed_protocols().
* @param array $block_context Optional. The block the attribute belongs to, in parsed block array format.
* @return string[]|string The filtered and sanitized result.
*/
function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array() ) {
function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array(), $block_context = null ) {
if ( is_array( $value ) ) {
foreach ( $value as $key => $inner_value ) {
$filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols );
$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols );
$filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols, $block_context );
$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols, $block_context );
if ( isset( $block_context['blockName'] ) && 'core/template-part' === $block_context['blockName'] ) {
$filtered_value = filter_block_core_template_part_attributes( $filtered_value, $filtered_key, $allowed_html );
}
if ( $filtered_key !== $key ) {
unset( $value[ $key ] );
@ -879,6 +885,28 @@ function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = ar
return $value;
}
/**
* Sanitizes the value of the Template Part block's `tagName` attribute.
*
* @since 6.5.5
*
* @param string $attribute_value The attribute value to filter.
* @param string $attribute_name The attribute name.
* @param array[]|string $allowed_html An array of allowed HTML elements and attributes,
* or a context name such as 'post'. See wp_kses_allowed_html()
* for the list of accepted context names.
* @return string The sanitized attribute value.
*/
function filter_block_core_template_part_attributes( $attribute_value, $attribute_name, $allowed_html ) {
if ( empty( $attribute_value ) || 'tagName' !== $attribute_name ) {
return $attribute_value;
}
if ( ! is_array( $allowed_html ) ) {
$allowed_html = wp_kses_allowed_html( $allowed_html );
}
return isset( $allowed_html[ $attribute_value ] ) ? $attribute_value : '';
}
/**
* Parses blocks out of a content string, and renders those appropriate for the excerpt.
*

@ -141,7 +141,7 @@ function render_block_core_template_part( $attributes ) {
global $wp_embed;
$content = $wp_embed->autoembed( $content );
if ( empty( $attributes['tagName'] ) ) {
if ( empty( $attributes['tagName'] ) || tag_escape( $attributes['tagName'] ) !== $attributes['tagName'] ) {
$defined_areas = get_allowed_block_template_part_areas();
$area_tag = 'div';
foreach ( $defined_areas as $defined_area ) {

@ -4707,12 +4707,13 @@ EOF;
* Escapes an HTML tag name.
*
* @since 2.5.0
* @since 6.5.5 Allow hyphens in tag names (i.e. custom elements).
*
* @param string $tag_name
* @return string
*/
function tag_escape( $tag_name ) {
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9_:]/', '', $tag_name ) );
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9-_:]/', '', $tag_name ) );
/**
* Filters a string cleaned and escaped for output as an HTML tag.
*

@ -5971,6 +5971,9 @@ function validate_file( $file, $allowed_files = array() ) {
return 0;
}
// Normalize path for Windows servers
$file = wp_normalize_path( $file );
// `../` on its own is not allowed:
if ( '../' === $file ) {
return 1;