From 3a4bf6180498bd735f57bf7accef9bd8b5ad2974 Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Wed, 29 Nov 2017 15:54:05 +0000 Subject: [PATCH] Hardening: Add escaping to the language attributes used on `html` elements. git-svn-id: https://develop.svn.wordpress.org/trunk@42259 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/general-template.php | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/wp-includes/general-template.php b/src/wp-includes/general-template.php index 55db605882..c579668615 100644 --- a/src/wp-includes/general-template.php +++ b/src/wp-includes/general-template.php @@ -3568,12 +3568,14 @@ function get_language_attributes( $doctype = 'html' ) { if ( function_exists( 'is_rtl' ) && is_rtl() ) $attributes[] = 'dir="rtl"'; - if ( $lang = get_bloginfo('language') ) { - if ( get_option('html_type') == 'text/html' || $doctype == 'html' ) - $attributes[] = "lang=\"$lang\""; + if ( $lang = get_bloginfo( 'language' ) ) { + if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) { + $attributes[] = 'lang="' . esc_attr( $lang ) . '"'; + } - if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' ) - $attributes[] = "xml:lang=\"$lang\""; + if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) { + $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"'; + } } $output = implode(' ', $attributes);