[wp-trac] [WordPress Trac] #40401: Value of data-colname in wp-list-table is not escaped

[WordPress Trac]

#40401: Value of data-colname in wp-list-table is not escaped
----------------------------+-----------------------------
 Reporter:  rellect         |      Owner:
     Type:  defect (bug)    |     Status:  new
 Priority:  normal          |  Milestone:  Awaiting Review
Component:  Administration  |    Version:  4.7.3
 Severity:  normal          |   Keywords:
  Focuses:                  |
----------------------------+-----------------------------
 It looks like at some point the esc_attr() was removed in favor of
 wp_strip_all_tags
 wp-admin/includes/class-wp-list-table.php
 {{{#!php
 <?php
 // Comments column uses HTML in the display name with screen reader text.
 // Instead of using esc_attr(), we strip tags to get closer to a user-
 friendly string.
 $data = 'data-colname="' . wp_strip_all_tags( $column_display_name ) .
 '"';

 }}}

 But wp_strip_all_tags does not escape the value, so wp_strip_all_tags
 should've been added as addition to esc_attr, and not as a replacement.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/40401>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform