From d17a57a945eccf8f01b80aeedbcede018560cdf2 Mon Sep 17 00:00:00 2001
From: Jake Spurlock <whyisjake@git.wordpress.org>
Date: Tue, 16 Jun 2020 16:55:45 +0000
Subject: [PATCH] Themes: Add additional later escaping to `post_class()` and
 `body_class()` functions.

Additionally, this adds a few tests to test output.

Fixes #20009.

Props mfields, scribu, azaozz, obenland, dd32, nacin, jrf, jdgrimes, garyj, whyisjake.



git-svn-id: https://develop.svn.wordpress.org/trunk@48060 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/post-template.php      |  4 ++--
 tests/phpunit/tests/post/bodyClass.php | 29 ++++++++++++++++++++++++++
 tests/phpunit/tests/post/postClass.php | 29 ++++++++++++++++++++++++++
 3 files changed, 60 insertions(+), 2 deletions(-)
 create mode 100644 tests/phpunit/tests/post/bodyClass.php
 create mode 100644 tests/phpunit/tests/post/postClass.php

diff --git a/src/wp-includes/post-template.php b/src/wp-includes/post-template.php
index bac6a507bc..164001e716 100644
--- a/src/wp-includes/post-template.php
+++ b/src/wp-includes/post-template.php
@@ -454,7 +454,7 @@ function has_excerpt( $post = 0 ) {
  */
 function post_class( $class = '', $post_id = null ) {
 	// Separates classes with a single space, collates classes for post DIV.
-	echo 'class="' . join( ' ', get_post_class( $class, $post_id ) ) . '"';
+	echo 'class="' . esc_attr( join( ' ', get_post_class( $class, $post_id ) ) ) . '"';
 }
 
 /**
@@ -590,7 +590,7 @@ function get_post_class( $class = '', $post_id = null ) {
  */
 function body_class( $class = '' ) {
 	// Separates class names with a single space, collates class names for body element.
-	echo 'class="' . join( ' ', get_body_class( $class ) ) . '"';
+	echo 'class="' . esc_attr( join( ' ', get_body_class( $class ) ) ) . '"';
 }
 
 /**
diff --git a/tests/phpunit/tests/post/bodyClass.php b/tests/phpunit/tests/post/bodyClass.php
new file mode 100644
index 0000000000..dbe65fcd1a
--- /dev/null
+++ b/tests/phpunit/tests/post/bodyClass.php
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @group post
+ * @covers ::body_class
+ */
+class Tests_Post_BodyClass extends WP_UnitTestCase {
+	protected $post_id;
+
+	public function setUp() {
+		parent::setUp();
+		$this->post_id = self::factory()->post->create();
+	}
+
+	public function test_body_class() {
+		$expected = 'class="' . join( ' ', get_body_class( '', $this->post_id ) ) . '"';
+		$this->expectOutputString( $expected );
+		body_class( '', $this->post_id );
+	}
+
+	public function test_body_class_extra_esc_attr() {
+		$classes              = get_body_class( '', $this->post_id );
+		$escaped_again        = array_map( 'esc_attr', $classes );
+		$escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
+
+		$this->expectOutputString( $escaped_another_time );
+		body_class( '', $this->post_id );
+	}
+}
diff --git a/tests/phpunit/tests/post/postClass.php b/tests/phpunit/tests/post/postClass.php
new file mode 100644
index 0000000000..f8501e9dc1
--- /dev/null
+++ b/tests/phpunit/tests/post/postClass.php
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @group post
+ * @covers ::post_class
+ */
+class Tests_Post_PostClass extends WP_UnitTestCase {
+	protected $post_id;
+
+	public function setUp() {
+		parent::setUp();
+		$this->post_id = self::factory()->post->create();
+	}
+
+	public function test_post_class() {
+		$expected = 'class="' . join( ' ', get_post_class( '', $this->post_id ) ) . '"';
+		$this->expectOutputString( $expected );
+		post_class( '', $this->post_id );
+	}
+
+	public function test_post_class_extra_esc_attr() {
+		$classes              = get_post_class( '', $this->post_id );
+		$escaped_again        = array_map( 'esc_attr', $classes );
+		$escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
+
+		$this->expectOutputString( $escaped_another_time );
+		post_class( '', $this->post_id );
+	}
+}