[wp-trac] [WordPress Trac] #61719: WP_HTML_Tag_Processor doesn't allow to set a valid image src

WordPress Trac noreply at wordpress.org
Mon Jul 22 18:12:59 UTC 2024


#61719: WP_HTML_Tag_Processor doesn't allow to set a valid image src
--------------------------+------------------------------
 Reporter:  ivanzhuck     |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  HTML API      |     Version:  6.6
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:
--------------------------+------------------------------

Comment (by dmsnell):

 Thanks for the report, @ivanzhuck.
 This is a result of bringing in `esc_url()` to `set_attribute()` in
 [58472] and [58473].

 Hopefully this will improve as we internalize the security guards, but in
 the meantime, it should return `false` if WordPress rejects the update.
 This could make for a quick patch if you want to propose one.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/61719#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform


More information about the wp-trac mailing list