Skip to content

Commit f1de7e4

Browse files
committed
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
Built from https://develop.svn.wordpress.org/trunk@42260 git-svn-id: http://core.svn.wordpress.org/trunk@42089 1a063a9b-81f0-0310-95a4-ce76da25c4cd
1 parent 3713ac5 commit f1de7e4

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

Diff for: wp-includes/feed.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -476,7 +476,7 @@ function rss_enclosure() {
476476
*
477477
* @param string $html_link_tag The HTML link tag with a URI and other attributes.
478478
*/
479-
echo apply_filters( 'rss_enclosure', '<enclosure url="' . trim( htmlspecialchars( $enclosure[0] ) ) . '" length="' . trim( $enclosure[1] ) . '" type="' . $type . '" />' . "\n" );
479+
echo apply_filters( 'rss_enclosure', '<enclosure url="' . esc_url( trim( $enclosure[0] ) ) . '" length="' . absint( trim( $enclosure[1] ) ) . '" type="' . esc_attr( $type ) . '" />' . "\n" );
480480
}
481481
}
482482
}
@@ -510,7 +510,7 @@ function atom_enclosure() {
510510
*
511511
* @param string $html_link_tag The HTML link tag with a URI and other attributes.
512512
*/
513-
echo apply_filters( 'atom_enclosure', '<link href="' . trim( htmlspecialchars( $enclosure[0] ) ) . '" rel="enclosure" length="' . trim( $enclosure[1] ) . '" type="' . trim( $enclosure[2] ) . '" />' . "\n" );
513+
echo apply_filters( 'atom_enclosure', '<link href="' . esc_url( trim( $enclosure[0] ) ) . '" rel="enclosure" length="' . absint( trim( $enclosure[1] ) ) . '" type="' . esc_attr( trim( $enclosure[2] ) ) . '" />' . "\n" );
514514
}
515515
}
516516
}

Diff for: wp-includes/version.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
*
55
* @global string $wp_version
66
*/
7-
$wp_version = '5.0-alpha-42259';
7+
$wp_version = '5.0-alpha-42260';
88

99
/**
1010
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

0 commit comments

Comments
 (0)