Social Link block: Obfuscate email address

[ockham]

What?

Obfuscate the email address in the "Mail" variation of the Social Icon block. See #21876 (comment).

Fixes #21876.

Why?

To make it harder for spambots to harvest email addresses.

How?

By using Core's antispambot() function.

Testing Instructions

• Insert a "Social Links" block into a new post, and add a "Mail" child block to it.
• Set an email address for that block.
• View the post on the frontend, and check its page source (not just the element inspector!).
• Verify that the email address is obfuscated (using HTML entities). Verify that the email address still works (e.g. by clicking on it).

For example, mailto:user@example.com becomes

mailto:user@example.com

Screenshots or screencast

Question

antispambot() has a second argument, $hex_encoding, to enable hex encoding (of entities). Should we use that?

FWIW, this is what mailto:user@example.com becomes with $hex_encoding === 1:

mailto:user@exa%6dple%2ecom

[ockham]

FYI @mrwweb

[ockham]

cc/ @sirreal if you happen to be around for a review tomorrow 😊 (Could be a candidate for inclusion in GB 17.4.0, for which the RC1 is scheduled to be published tomorrow. cc/ @bph )

[Mamaduka]

Thank you, @ockham!

The changes look good to me.

I wonder if we should make this optional, but I guess we can do that later if there's a request for it.

[ockham]

I just noticed that we might have to change the escaping from esc_url() to esc_attr() if we're dealing with an email:

gutenberg/packages/block-library/src/social-link/index.php

Line 56 in 6d4440a

$link .= '<a href="' . esc_url( $url ) . '" class="wp-block-social-link-anchor">';

see https://developer.wordpress.org/reference/functions/antispambot/#comment-2779:

Escaping URL in href attribute will add http:// before email address. In lack of better option, it’s more appropriate to use esc_attr() instead.

(unless esc_url() has been changed since? Need to check.)

[ockham]

Ah, disregard my previous comment.

See https://github.com/WordPress/wordpress-develop/blob/0e284447951869fd3ff58b345ec070b0ab97d9bc/src/wp-includes/default-filters.php#L302 and https://github.com/WordPress/wordpress-develop/blob/0e284447951869fd3ff58b345ec070b0ab97d9bc/src/wp-admin/includes/class-wp-comments-list-table.php#L997-L1000. (esc_url() is used to escape 'mailto:' . $email, after $email has been run through antispambot().)

[sirreal]

Tested and working as expected 👍