Strip HTML tags in privacy policy link - #11088
shail-mehta wants to merge 13 commits into
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
huzaifaalmesbah
left a comment
huzaifaalmesbah
left a comment
There was a problem hiding this comment.
Looks Good
| Before Apply Patch | After Apply Patch ✅ |
|---|---|
 |
 |
| '<a class="privacy-policy-link" href="%s" rel="privacy-policy">%s</a>', | ||
| esc_url( $privacy_policy_url ), | ||
| esc_html( $page_title ) | ||
| wp_kses_post( $page_title ) |
There was a problem hiding this comment.
Technically, since get_the_title() was used, is Kses even needed? True it would be nicer for late escaping, but it would also be redundant:
| wp_kses_post( $page_title ) | |
| $page_title |
Not saying we should do this, but I wanted to point this out.
There was a problem hiding this comment.
WP core use esc_html for get_the_title in many places https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop%20esc_html(%20get_the_title&type=code Do we needs to open separate issue for this to review all those instances?
Can we update the codebase something like:
$link = '';
$privacy_policy_url = get_privacy_policy_url();
$policy_page_id = (int) get_option( 'wp_page_for_privacy_policy' );
if ( $privacy_policy_url && $policy_page_id ) {
$link = sprintf(
'<a class="privacy-policy-link" href="%s" rel="privacy-policy">%s</a>',
esc_url( $privacy_policy_url ),
get_the_title( $policy_page_id ) ?? ''
);
}There was a problem hiding this comment.
Here is a smaller set with a more tailored regex: https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+%2Fesc_html%5C%28+get_the_title%5C%28%2F&type=code
This doesn't catch cases where get_the_title() is stored in a variable and then later echoed.
I think it would sense to change the scope of the ticket to address this issue for all these cases.
There was a problem hiding this comment.
get_the_title() needs to keep some escaping/cleaning.
Consider this absurdly extreme example for the title I added in Quick Edit:
<p class="privacy-policy-link"><span style="color:darkgreen">P</span><b>r</b><i>i</i><strong>v</strong><em>a</em><code>c</code><kbd>y</kbd></p><div> </div><h1>P</h1><h2>o</h2><h3>l</h3><h4>i</h4><h5>c</h5><h6>y</h6><span> & <a>Terms</a></span><style>.privacy-policy-link{font-size:1.2em}</style><script>console.log('privacy-policy-link');</script>
The link(s) should not allow style or script tags, the a element does not fit within a link, and I do not know of a case in which any of the block elements would be appropriate.
If someone wants the entire link text bold or italic, that would be better in CSS than adding HTML in the title wherever it appears. In the case when someone wants part of the title emphasized, such as <strong>Privacy</strong> Policy, the link filter can un-escape the desired element right now with esc_html().
function enable_strong_in_the_privacy_policy_link( $link ) {
if ( str_contains( $link, '<' ) ) {
$link = str_replace(
array( '<strong>', '</strong>' ),
array( '<strong>', '</strong>' ),
$link
);
}
return $link;
}
add_filter( 'the_privacy_policy_link', 'enable_strong_in_the_privacy_policy_link' );
Similarly, if the function switches to wp_strip_all_tags(), someone could use the filter to replace Privacy with <strong>Privacy</strong>.
If we have clear examples of appropriate tags to start allowing for any site, the function(s) could use
wp_kses( $page_title, array( 'strong' => array(), 'em' => array() ) )
There was a problem hiding this comment.
I think there's a reasonable case for span, as well. From a design perspective, you sometimes want markup that doesn't have pre-defined style expectations or existing semantics. But I can't see a strong case outside those limits.
There was a problem hiding this comment.
@shail-mehta would you be open to expand the PR to support:
- strong
- em
- b
- i
- span (with css classes)
As well it would be great if we could make it consistent inside the codebase. A unit test could help cover this moving forward.
|
Should we consider removing |
|
Yes. Update: But probably with KSES to allowlist a specific set of formatting tags. |
|
@shail-mehta as we have a way forward would you mind checking #11088 (comment) and let me know if you'd like to move this forward? |
|
Sure, I'll work on this PR this weekend. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
src/wp-includes/link-template.php:4823
- This change modifies how the privacy policy page title is sanitized in the rendered link, but there is no test coverage for titles containing HTML. Adding a unit test case (e.g. a privacy policy page title with
<img>/<a>/<strong>tags) would prevent regressions and codify the expected “strip tags” behavior.
wp_kses_post( $page_title )
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
src/wp-admin/comment.php:237
- There is an extra closing tag, which produces invalid table markup (double-closing the same cell). Remove the redundant closing tag to keep the table structure valid.
</td>
</td>
src/wp-includes/link-template.php:4832
- The PR description says this change uses
wp_kses_post(), but the implementation useswp_kses()with a custom allowlist (and the PR title/description focus on the privacy policy link, while this PR also changes multiple other title outputs). Please align the PR description/title with the implemented approach/scope, or adjust the implementation ifwp_kses_post()/different scoping is the intended requirement.
$link = sprintf(
'<a class="privacy-policy-link" href="%s" rel="privacy-policy">%s</a>',
esc_url( $privacy_policy_url ),
wp_kses(
$page_title,
array(
'strong' => array(),
'em' => array(),
'b' => array(),
'i' => array(),
'span' => array(),
)
)
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
src/wp-admin/comment.php:237
- There is an extra closing here, which produces invalid table markup (two consecutive tags for the same cell).
</td>
</td>
| <a href="<?php echo esc_url( get_permalink( $year_post ) ); ?>"> | ||
| <?php | ||
| echo wp_kses( | ||
| $title, | ||
| array( | ||
| 'strong' => array(), | ||
| 'em' => array(), | ||
| 'b' => array(), | ||
| 'i' => array(), | ||
| 'span' => array(), | ||
| ) | ||
| ); |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
src/wp-admin/comment.php:240
- There is an extra closing
</td>in this row, which results in invalid table markup and can break the layout of the comment edit screen.
</td>
</td>
</tr>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (2)
src/wp-admin/comment.php:240
- There is an extra closing which results in invalid table markup (a is closed twice). This can break the layout of the comment edit screen.
</td>
</td>
</tr>
src/wp-includes/link-template.php:4825
- The PR title/description focus on the privacy policy link, but this change set also updates title sanitization/output in several other admin and theme templates (e.g. comment screens, nav menu editor, dashboard widget, Twenty Twenty-One). If that broader scope is intended, please update the PR title/description accordingly; otherwise consider splitting/reducing the changes to the privacy-policy-link fix for easier review.
$link = sprintf(
'<a class="privacy-policy-link" href="%s" rel="privacy-policy">%s</a>',
esc_url( $privacy_policy_url ),
wp_kses(
$page_title,
array(
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
src/wp-admin/comment.php:240
- There is an extra closing
</td>here, which results in invalid table markup (two</td>closing tags for the same cell).
</td>
</td>
</tr>
| 'post_title' => '<strong>Privacy</strong> <em>Policy</em> <b>Bold</b> <i>Italic</i> <script>alert("test")</script>', | ||
|
|
||
| ) | ||
|
|
||
| $privacy_policy_page_id = self::$privacy_policy_page_id; | ||
| $filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) { | ||
| if ( (int) $privacy_policy_page_id === (int) $post_id ) { | ||
| return '<span class="page-title">' . $title . '</span>'; | ||
| } | ||
|
|
||
| return $title; | ||
| }; | ||
|
|
||
| add_filter( 'the_title', $filter, 10, 2 ); | ||
| } | ||
|
|
||
|
|
||
|
|
||
| return $title; | ||
|
|
||
| }; | ||
|
|
||
|
|
||
|
|
||
| add_filter( 'the_title', $filter, 10, 2 ); |
| $post_title = wp_kses( | ||
| get_the_title( $post_id ), | ||
| array( | ||
| 'strong' => array(), | ||
| 'em' => array(), | ||
| 'b' => array(), | ||
| 'i' => array(), | ||
| 'span' => array( | ||
| 'class' => true, | ||
| ), | ||
|
|
||
| ) | ||
| ); |
There was a problem hiding this comment.
This feels like duplicate logic across multiple files. I'm not sure if it's worth it, but perhaps we could extract it into a utility function and reuse it instead.
WDYT?
peterwilsoncc
left a comment
peterwilsoncc
left a comment
There was a problem hiding this comment.
I think it would be best to keep this focused on the display of the privacy policy link as that is affecting the front end display.
That will allow for the display of titles within the admin to be handled as a separate issue and discussed with a focus on what is best within the admin.
Merge latest trunk and keep HTML formatting support only on the front-end privacy policy link, leaving admin title display for a separate change.
The file was saved with CRLF, so the pull request diff rewrote every line.
The markup test did not parse and had extra blank lines that fail PHPCS.
Inject title markup through the_title after core formatting filters so the assertion is not affected by wptexturize or title-save KSES.
Thanks @peterwilsoncc. Updated to limit this PR to the privacy policy link only. |
Trac ticket: https://core.trac.wordpress.org/ticket/64748
wp_kses()instead ofesc_html()Use of AI Tools
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.