[wp-trac] [WordPress Trac] #30952: customize.php links in the admin menu are not ecaped

[WordPress Trac]

#30952: customize.php links in the admin menu are not ecaped
-------------------------------------+-----------------------------
 Reporter:  avryl                    |       Owner:
     Type:  defect (bug)             |      Status:  new
 Priority:  normal                   |   Milestone:  4.2
Component:  Customize                |     Version:  4.1
 Severity:  normal                   |  Resolution:
 Keywords:  has-patch needs-refresh  |     Focuses:  administration
-------------------------------------+-----------------------------

Comment (by westonruter):

 Isn't there a more fundamental problem here for escaping? The
 `_wp_menu_output()` is not always calling `esc_url()` when echoing out the
 menu items. So it seems that something like [attachment:30952.demo.diff]
 would be a more robust improvement.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/30952#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform