Privacy: Escape comment URLs in personal export file to prevent XSS.
There doesn't appear to be any way for an attacker to introduce malicious input into the URL, unless a plugin is filtering the URL to add it, but it's better to be safe than sorry. Props birgire. Fixes #44054. git-svn-id: https://develop.svn.wordpress.org/trunk@43245 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
parent
5e9a39baa7
commit
239471ade4
|
@ -3353,7 +3353,11 @@ function wp_comments_personal_data_exporter( $email_address, $page = 1 ) {
|
|||
|
||||
case 'comment_link':
|
||||
$value = get_comment_link( $comment->comment_ID );
|
||||
$value = '<a href="' . $value . '" target="_blank" rel="noreferrer noopener">' . $value . '</a>';
|
||||
$value = sprintf(
|
||||
'<a href="%s" target="_blank" rel="noreferrer noopener">%s</a>',
|
||||
esc_url( $value ),
|
||||
esc_html( $value )
|
||||
);
|
||||
break;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue