[wp-trac] [WordPress Trac] #53973: WordPress <= 5.8 - Authenticated Persistent XSS (User role name)

[WordPress Trac]

#53973: WordPress <= 5.8 - Authenticated Persistent XSS (User role name)
--------------------------+-----------------------------
 Reporter:  visse         |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Future Release
Component:  Security      |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  has-patch     |     Focuses:  administration
--------------------------+-----------------------------
Changes (by desrosj):

 * keywords:  dev-feedback has-patch => has-patch
 * milestone:  Awaiting Review => Future Release


Comment:

 @ramon-fincken Thanks for the patch!

 Some questions and requests:

 - Could you open a pull request against `wordpress-develop` on GitHub so
 that we can confirm all tests pass as expected?
 - Could you also add a few test assertions that demonstrate the problem is
 gone? This will help protect against accidentally reintroducing the
 problem.
 - I'm curious the reasoning behind returning instead of using the value
 run through sanitization. For example, running the `$slug` through
 `sanitize_title()` and the `$display_name` through `esc_html()` should be
 enough to then continue on with the function instead of silently failing.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/53973#comment:9>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform