[wp-trac] [WordPress Trac] #41215: Escaping the value of the srcset attribute

[WordPress Trac]

#41215: Escaping the value of the srcset attribute
-----------------------------------------+------------------------------
 Reporter:  henry.wright                 |       Owner:
     Type:  defect (bug)                 |      Status:  new
 Priority:  normal                       |   Milestone:  Awaiting Review
Component:  General                      |     Version:
 Severity:  normal                       |  Resolution:
 Keywords:  has-patch reporter-feedback  |     Focuses:
-----------------------------------------+------------------------------
Changes (by joemcgill):

 * keywords:   => has-patch reporter-feedback


Comment:

 Hi @henry.wright most likely, `esc_attr()` was used because the `srcset`
 attribute is a string like:

 `http://1.gravatar.com/avatar/{some_img_id}?s=64&d=mm&r=g 2x`

 Where the x descriptor at the end of the string means that it's not really
 a URL. Since this is a fairly simple `srcset` implementation, we could
 probably use `esc_url()` on just the URL part of the image source.
 [attachment:41215.diff] shows how that would work.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/41215#comment:1>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform