[wp-trac] [WordPress Trac] #58336: Potential XSS on admin_body_class hook

[WordPress Trac]

#58336: Potential XSS on admin_body_class hook
--------------------------+-----------------------------
 Reporter:  rafiem        |       Owner:  SergeyBiryukov
     Type:  defect (bug)  |      Status:  reopened
 Priority:  normal        |   Milestone:  6.3
Component:  Security      |     Version:
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:
--------------------------+-----------------------------

Comment (by lgladdy):

 I think for me, the thing this meant this one should have been fixed, is
 that the same non-admin filter, `body_class`, does escape everything, but
 `admin_body_class` didn't.

 That feels like a discrepancy which made it more likely to be overlooked
 by plugin and theme devs.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/58336#comment:11>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform