Skip to content

Escape URLs interpolated into markup #814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
obenland wants to merge 13 commits into
base: trunk
Choose a base branch
from
Open

Escape URLs interpolated into markup #814

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
ef2f31e
Escape URLs interpolated into markup.
obenland Aug 18, 2026
6c3e2c9
BuddyPress.org, WordPress.tv: Use get_theme_file_uri() for theme assets.
obenland Aug 18, 2026
a7de769
PHPCS: Treat wporg_login_wordpress_url() as pre-escaped output.
obenland Aug 18, 2026
04a56ff
Browse Happy, bb-base: Escape the remaining URLs in output.
obenland Aug 18, 2026
498ef49
Escape URLs held in variables.
obenland Aug 18, 2026
c45efbd
Openverse: Sanitize the request path used to build the redirect target.
obenland Aug 18, 2026
7462c8f
Escape variables that carry prebuilt links.
obenland Aug 18, 2026
27ab3bf
Escape the remaining URLs the sniff could not follow.
obenland Aug 18, 2026
2c6adf2
Escape plugin tags and handbook titles where they are assembled.
obenland Aug 18, 2026
bf1fc83
Escape the archive, edit and feed links.
obenland Aug 18, 2026
368a3e9
Address review feedback on the URL escaping sweep.
obenland Aug 18, 2026
a24c8dd
Escape WPTV search and OGG link outputs
obenland Aug 18, 2026
3e90209
Forums: Split the review notice's chained assignment.
obenland Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 14 additions & 13 deletions browsehappy.com/public_html/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,17 @@
<?php defined( 'ABSPATH' ) or die(); ?>
<?php
/**
* The main template file.
*
* phpcs:disable WordPress.WP.EnqueuedResources
*
* @package browsehappy
*/

defined( 'ABSPATH' ) || die();
?>
<!DOCTYPE html>

<!--[if lt IE 7 ]> <html <?php language_attributes(); ?> class="no-js ie6"> <![endif]-->
<!--[if IE 7 ]> <html <?php language_attributes(); ?> class="no-js ie7"> <![endif]-->
<!--[if IE 8 ]> <html <?php language_attributes(); ?> class="no-js ie8"> <![endif]-->
<!--[if IE 9 ]> <html <?php language_attributes(); ?> class="no-js ie9"> <![endif]-->
<!--[if (gt IE 9)|!(IE)]><!--> <html <?php language_attributes(); ?> class="no-js"> <!--<![endif]-->
<html <?php language_attributes(); ?> class="no-js">

<head>
<meta charset="utf-8">
Expand All @@ -14,16 +20,11 @@
<meta name="author" content="WordPress" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />

<link rel="stylesheet" href="<?php echo get_template_directory_uri(); ?>/style.css?15" />
<script src="<?php echo get_template_directory_uri(); ?>/js/modernizr-1.6.min.js"></script>
<link rel="stylesheet" href="<?php echo esc_url( get_template_directory_uri() . '/style.css?15' ); ?>" />
<script src="<?php echo esc_url( get_template_directory_uri() . '/js/modernizr-1.6.min.js' ); ?>"></script>
<script src="https://use.typekit.com/lsw6yis.js"></script>
<script type="text/javascript">try{Typekit.load();}catch(e){}</script>

<!--[if lt IE 7]>
<script src="<?php echo get_template_directory_uri(); ?>/js/pngfix.min.js"></script>
<script>DD_belatedPNG.fix('#i18n-alert, header, #browserlist li .icon, footer, #share nav li a, #byline a');</script>
<![endif]-->

<?php wp_head(); ?>
</head>

Expand Down
13 changes: 0 additions & 13 deletions browsehappy.com/public_html/js/pngfix.min.js
View file
Open in desktop

This file was deleted.

32 changes: 0 additions & 32 deletions browsehappy.com/public_html/style.css
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,14 +355,6 @@ html[dir="rtl"] #browserlist li {
background: url(imgs/alphabg.png) repeat;
}

.ie6 #browserlist h2 {
background: #E7DECD; /* 24-bit PNG not supported in IE6, replacing with flat color */
}

.ie6 #browserlist li a:hover h2 {
background: #EEE8DC; /* Lighter color on hover to simulate transparency */
}

#browserlist p {
padding: 0 5px;
text-shadow: 0 1px 0 rgba(255,255,255,.8);
Expand All @@ -372,10 +364,6 @@ html[dir="rtl"] #browserlist li {
min-height: 150px;
}

.ie6 #browserlist p.info {
height: 120px; /* Fix for min-height bug */
}

#browserlist p.version {
margin-bottom: 10px;
text-align: center;
Expand All @@ -396,10 +384,6 @@ html[dir="rtl"] #browserlist li {
background: url(imgs/alphabg.png) repeat;
}

.ie6 #browserlist p.website {
background: #E7DECD; /* 24-bit PNG not supported in IE6, replacing with flat color */
}

#browserlist li a:link, #browserlist li a:visited {
color: #324B4B;
padding: 10px;
Expand All @@ -422,10 +406,6 @@ html[dir="rtl"] #browserlist li {
background: url(imgs/alphabg.png) repeat;
}

.ie6 #browserlist li a:hover {
background: #E7DECD; /* 24-bit PNG not supported in IE6, replacing with flat color */
}

#browserlist li a:hover .website {
background: #4daaa7;
color: #fff;
Expand Down Expand Up @@ -515,10 +495,6 @@ footer h2 {
margin-left: 15px;
}

.ie6 #about {
display: inline; /* Fix for double margin float bug */
}

#share {
width: 30%;
float: right;
Expand All @@ -535,10 +511,6 @@ html[dir="rtl"] #share {
float: left;
}

.ie6 #share {
display: inline; /* Fix for double margin float bug */
}

#share nav li {
width: 32px;
height: 32px;
Expand All @@ -552,10 +524,6 @@ html[dir="rtl"] #share nav li {
margin-left: 9px;
}

.ie6 #share nav li {
display: inline; /* Fix for double margin float bug */
}

#share nav li a {
width: 32px;
height: 32px;
Expand Down
4 changes: 2 additions & 2 deletions buddypress.org/public_html/wp-content/themes/bb-base/attachment.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
<div class="post" id="post-<?php the_ID(); ?>">
<h1><a href="<?php the_permalink() ?>" rel="bookmark" title="<?php printf( esc_attr__( 'Permanent Link to %s', 'bborg' ), the_title_attribute( [ 'echo' => false ] ) ); ?>"><?php the_title(); ?></a></h1>
<label class="date"><?php the_time( 'F jS, Y' ); ?></label>
<p class="<?php echo esc_attr( $classname ); ?>"><?php echo $attachment_link; ?><br /><?php echo basename($post->guid); ?></p>
<p class="<?php echo esc_attr( $classname ); ?>"><?php echo wp_kses_post( $attachment_link ); ?><br /><?php echo esc_html( basename( $post->guid ) ); ?></p>
<?php
the_content( __( 'Check it out!', 'bborg' ) );
wp_link_pages( array(
Expand All @@ -30,7 +30,7 @@
get_the_time( 'l, F jS, Y' ),
get_the_time(),
get_the_category_list(', '),
get_post_comments_feed_link()
esc_url( get_post_comments_feed_link() )
);

if ( 'open' == $post->comment_status && 'open' == $post->ping_status ) :
Expand Down
11 changes: 10 additions & 1 deletion buddypress.org/public_html/wp-content/themes/bb-base/bbpress/loop-single-topic.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,16 @@

<?php do_action( 'bbp_theme_before_topic_started_in' ); ?>

<span class="bbp-topic-started-in"><?php printf( __( 'in: <a href="%1$s">%2$s</a>', 'bbpress' ), bbp_get_forum_permalink( bbp_get_topic_forum_id() ), bbp_get_forum_title( bbp_get_topic_forum_id() ) ); ?></span>
<span class="bbp-topic-started-in">
<?php
printf(
/* translators: 1: URL of the forum, 2: Name of the forum. */
wp_kses_post( __( 'in: <a href="%1$s">%2$s</a>', 'bbpress' ) ),
esc_url( bbp_get_forum_permalink( bbp_get_topic_forum_id() ) ),
esc_html( bbp_get_forum_title( bbp_get_topic_forum_id() ) )
);
?>
</span>

<?php do_action( 'bbp_theme_after_topic_started_in' ); ?>

Expand Down
2 changes: 1 addition & 1 deletion buddypress.org/public_html/wp-content/themes/bb-base/comments.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
<?php else : ?>

<div id="respond">
<form action="<?php echo site_url( '/wp-comments-post.php' ); ?>" method="post" id="commentform">
<form action="<?php echo esc_url( site_url( '/wp-comments-post.php' ) ); ?>" method="post" id="commentform">
<fieldset>
<legend><?php comment_form_title( esc_html__( 'Leave a Reply', 'bborg' ), esc_html__( 'Leave a Reply to %s', 'bborg' ) ); ?></legend>
<p class="cancel-reply"><?php cancel_comment_reply_link( esc_html__( 'Cancel Comment Reply', 'bborg' ) ); ?></p>
Expand Down
8 changes: 4 additions & 4 deletions buddypress.org/public_html/wp-content/themes/bb-base/header-nav.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@
<a href="#" id="bb-menu-icon"></a>
<?php if ( ! has_nav_menu( 'header-nav-menu' ) ) : ?>
<ul id="bb-nav" class="menu">
<li <?php if ( is_page( 'about' ) ) : ?>class="current"<?php endif; ?>><a href="<?php echo home_url( 'about' ); ?>"><?php esc_html_e( 'About', 'bborg' ); ?></a></li>
<li <?php if ( is_page( 'make' ) ) : ?>class="current"<?php endif; ?>><a href="<?php echo home_url( 'make' ); ?>"><?php esc_html_e( 'Make', 'bborg' ); ?></a></li>
<li <?php echo is_page( 'about' ) ? 'class="current"' : ''; ?>><a href="<?php echo esc_url( home_url( 'about' ) ); ?>"><?php esc_html_e( 'About', 'bborg' ); ?></a></li>
<li <?php echo is_page( 'make' ) ? 'class="current"' : ''; ?>><a href="<?php echo esc_url( home_url( 'make' ) ); ?>"><?php esc_html_e( 'Make', 'bborg' ); ?></a></li>
<li><a href="<?php echo esc_url( '//codex.' . parse_url( home_url(), PHP_URL_HOST ) . '/' ); ?>"><?php esc_html_e( 'Codex', 'bborg' ); ?></a></li>
<li <?php if ( is_post_type_archive( 'post' ) || is_singular( 'post' ) || is_date() || is_tag() || is_category() || is_home() ) : ?>class="current"<?php endif; ?>><a href="<?php echo home_url( 'blog' ); ?>"><?php esc_html_e( 'News', 'bborg' ); ?></a></li>
<li <?php echo ( is_post_type_archive( 'post' ) || is_singular( 'post' ) || is_date() || is_tag() || is_category() || is_home() ) ? 'class="current"' : ''; ?>><a href="<?php echo esc_url( home_url( 'blog' ) ); ?>"><?php esc_html_e( 'News', 'bborg' ); ?></a></li>
<?php if ( function_exists( 'is_bbpress' ) ) : ?><li <?php if ( is_bbpress() && ! is_front_page() ) : ?>class="current"<?php endif; ?>><a href="<?php bbp_forums_url(); ?>"><?php esc_html_e( 'Forums', 'bborg' ); ?></a></li><?php endif; ?>
<li class="download<?php if ( is_page( 'download' ) ) : ?> current<?php endif; ?>"><a href="<?php echo home_url( 'download' ); ?>"><?php esc_html_e( 'Download', 'bborg' ); ?></a></li>
<li class="download<?php echo is_page( 'download' ) ? ' current' : ''; ?>"><a href="<?php echo esc_url( home_url( 'download' ) ); ?>"><?php esc_html_e( 'Download', 'bborg' ); ?></a></li>
</ul>
<?php else: ?>
<?php wp_nav_menu( array(
Expand Down
4 changes: 2 additions & 2 deletions buddypress.org/public_html/wp-content/themes/bb-base/header-subnav.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@

<ul id="nav-user" class="menu">
<?php if ( ! is_user_logged_in() ) : ?>
<li><a href="<?php echo wp_login_url(); ?>"><?php esc_html_e( 'Log In', 'bborg' ); ?></a></li>
<li><a href="<?php echo wp_registration_url(); ?>"><?php esc_html_e( 'Register', 'bborg' ); ?></a></li>
<li><a href="<?php echo esc_url( wp_login_url() ); ?>"><?php esc_html_e( 'Log In', 'bborg' ); ?></a></li>
<li><a href="<?php echo esc_url( wp_registration_url() ); ?>"><?php esc_html_e( 'Register', 'bborg' ); ?></a></li>
<?php elseif ( function_exists( 'bbp_favorites_permalink' ) ) : ?>
<li><a href="<?php bbp_favorites_permalink( bbp_get_current_user_id() ); ?>"><?php esc_html_e( 'Favorites', 'bborg' ); ?></a></li>
<li><a href="<?php bbp_subscriptions_permalink( bbp_get_current_user_id() ); ?>"><?php esc_html_e( 'Subscriptions', 'bborg' ); ?></a></li>
Expand Down
4 changes: 2 additions & 2 deletions buddypress.org/public_html/wp-content/themes/bb-base/image.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@
while ( have_posts() ) :
the_post();
?>
<h2 id="post-<?php the_ID(); ?>"><a href="<?php echo get_permalink($post->post_parent); ?>" rev="attachment"><?php echo get_the_title($post->post_parent); ?></a> &raquo; <?php the_title(); ?></h2>
<p class="attachment"><a href="<?php echo wp_get_attachment_url($post->ID); ?>"><?php echo wp_get_attachment_image( $post->ID, 'medium' ); ?></a></p>
<h2 id="post-<?php the_ID(); ?>"><a href="<?php echo esc_url( get_permalink( $post->post_parent ) ); ?>" rev="attachment"><?php echo esc_html( get_the_title( $post->post_parent ) ); ?></a> &raquo; <?php the_title(); ?></h2>
<p class="attachment"><a href="<?php echo esc_url( wp_get_attachment_url( $post->ID ) ); ?>"><?php echo wp_get_attachment_image( $post->ID, 'medium' ); ?></a></p>
<p class="wp-caption"><?php if ( !empty($post->post_excerpt) ) the_excerpt(); // this is the "caption" ?></p>
<?php the_content( esc_html__( 'Read more &laquo;', 'bborg' ) ); ?>
<dl id="meta">
Expand Down
6 changes: 3 additions & 3 deletions buddypress.org/public_html/wp-content/themes/bb-base/sidebar.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,15 +95,15 @@

<div class="feature">
<h2><?php _e('WordPress', 'bbporg'); ?></h2>
<p><a href="https://wordpress.org"><img width="78" height="58" alt="" src="<?php echo get_template_directory_uri(); ?>/images/wordpress.gif"/></a><?php esc_html_e( 'The world&#8217;s most powerful web publishing software.', 'bborg' ); ?></p>
<p><a href="https://wordpress.org"><img width="78" height="58" alt="" src="<?php echo esc_url( get_template_directory_uri() . '/images/wordpress.gif' ); ?>"/></a><?php esc_html_e( 'The world&#8217;s most powerful web publishing software.', 'bborg' ); ?></p>
</div>
<div class="feature">
<h2><?php _e('bbPress', 'bbporg'); ?></h2>
<p><a href="https://bbpress.org"><img width="78" height="58" alt="" src="<?php echo get_template_directory_uri(); ?>/images/bbpress.gif"/></a><?php esc_html_e( 'Simple and elegant forum software from the creators of WordPress.', 'bborg' ); ?></p>
<p><a href="https://bbpress.org"><img width="78" height="58" alt="" src="<?php echo esc_url( get_template_directory_uri() . '/images/bbpress.gif' ); ?>"/></a><?php esc_html_e( 'Simple and elegant forum software from the creators of WordPress.', 'bborg' ); ?></p>
</div>
<div style="margin-right: 0pt;" class="feature">
<h2><?php _e('BuddyPress', 'bbporg'); ?></h2>
<p><a href="https://buddypress.org"><img width="78" height="58" alt="" src="<?php echo get_template_directory_uri(); ?>/images/buddypress.gif"/></a><?php esc_html_e( 'Create a fully featured niche social-network with a few easy clicks.', 'bborg' ); ?></p>
<p><a href="https://buddypress.org"><img width="78" height="58" alt="" src="<?php echo esc_url( get_template_directory_uri() . '/images/buddypress.gif' ); ?>"/></a><?php esc_html_e( 'Create a fully featured niche social-network with a few easy clicks.', 'bborg' ); ?></p>
</div>

<?php elseif ( ( ! is_page( 'login' ) && ! is_page( 'register' ) && ! is_page( 'lost-password' ) ) || is_home() || is_singular( 'post' ) || is_archive() ) : ?>
Expand Down
Loading