From ef20417bf3ef6ef06532ee1ab30c4ed3af748e2d Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Wed, 29 Nov 2017 16:29:35 +0000 Subject: [PATCH] Hardening: Add escaping to the language attributes used on `html` elements. Merges [42259] to the 4.3 branch. git-svn-id: https://develop.svn.wordpress.org/branches/4.3@42289 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/general-template.php | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/wp-includes/general-template.php b/src/wp-includes/general-template.php index 8f2cdf67aa..c1a4c42aa0 100644 --- a/src/wp-includes/general-template.php +++ b/src/wp-includes/general-template.php @@ -2627,12 +2627,14 @@ function get_language_attributes( $doctype = 'html' ) { if ( function_exists( 'is_rtl' ) && is_rtl() ) $attributes[] = 'dir="rtl"'; - if ( $lang = get_bloginfo('language') ) { - if ( get_option('html_type') == 'text/html' || $doctype == 'html' ) - $attributes[] = "lang=\"$lang\""; + if ( $lang = get_bloginfo( 'language' ) ) { + if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) { + $attributes[] = 'lang="' . esc_attr( $lang ) . '"'; + } - if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' ) - $attributes[] = "xml:lang=\"$lang\""; + if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) { + $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"'; + } } $output = implode(' ', $attributes);