[wp-trac] [WordPress Trac] #52894: The wp_sanitize_script_attributes function added in version 5.7 does not escape attributes in some cases.

[WordPress Trac]

#52894: The wp_sanitize_script_attributes function added in version 5.7 does not
escape attributes in some cases.
------------------------------+---------------------
 Reporter:  tmatsuur          |       Owner:  (none)
     Type:  defect (bug)      |      Status:  new
 Priority:  normal            |   Milestone:  5.7.1
Component:  Script Loader     |     Version:  5.7
 Severity:  critical          |  Resolution:
 Keywords:  has-patch commit  |     Focuses:
------------------------------+---------------------
Changes (by peterwilsoncc):

 * keywords:  has-patch => has-patch commit


Comment:

 Strictly speaking, @joyously is correct. While browsers can handle
 entities, the `/` in the example above confuses browsers and causes the
 attribute to be split in to two (tested in Firefox on macOS):

 {{{
 >console.log("hello");console.log('world')<
 script><script
 }}}

 From the security perspective of keeping the visitor safe, it's doing the
 job so I think it's good to go in. As sanitization is a semi defined
 umbrella term for some combination of validation, escaping and filtering I
 think the name is fine for now.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/52894#comment:5>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform