[wp-trac] [WordPress Trac] #11811: insufficient sanitization in get_body_class()

[WordPress Trac]

#11811: insufficient sanitization in get_body_class()
-------------------------------+--------------------------------------------
 Reporter:  Denis-de-Bernardy  |       Owner:     
     Type:  defect (bug)       |      Status:  new
 Priority:  normal             |   Milestone:  3.0
Component:  Validation         |     Version:  3.0
 Severity:  normal             |    Keywords:     
-------------------------------+--------------------------------------------
 following up on #11439, the template file could be something like
 foo.bar.php, which is an invalid css class.

 likewise, the $class argument could potentially contain unsanitized class
 names.

 we should change sanitize_html_class so as to make its second argument
 default to an empty string, and array map the resulting mess accordingly.

 the same might apply for get_post_class()

 (lastly, and slightly off topic, there is a preg_split() call with a \s
 class in it. at some point, we'll need to make this stuff work with utf8
 chars, which would require the /u delimiter.)

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/11811>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software