[wp-trac] [WordPress Trac] #56117: Need escaping in class-wp-rest-widget-types-controller file

[WordPress Trac]

#56117: Need escaping in class-wp-rest-widget-types-controller file
---------------------------+----------------------
 Reporter:  priyankkpatel  |       Owner:  (none)
     Type:  defect (bug)   |      Status:  closed
 Priority:  normal         |   Milestone:
Component:  REST API       |     Version:
 Severity:  normal         |  Resolution:  invalid
 Keywords:                 |     Focuses:
---------------------------+----------------------
Changes (by TimothyBlynJacobs):

 * status:  new => closed
 * resolution:   => invalid
 * milestone:  Awaiting Review =>


Comment:

 WordPress practices late escaping. In other words, unsafe values should be
 escaped as close to their output as possible. Preemptively escaping every
 value that is passed to a function would be unnecessary and can sometimes
 lead to security issues itself.

 Instead, you'd need to look at the function being called,
 `render_block_core_legacy_widget` and evaluate if there were any places
 where output was generated without being properly escaped.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/56117#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform