This repository has been archived by the owner on Feb 23, 2024. It is now read-only.
Refactor/escape all values #7797
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The release ZIP for this PR is accessible via: |
TypeScript Errors ReportFiles with errors: 432 🎉 🎉 This PR does not introduce new TS errors. |
|
Size Change: 0 B Total Size: 972 kB ℹ️ View Unchanged
|
imanish003
added
type: refactor
Whenever you’re rendering data, make sure to properly escape it. Escaping output prevents XSS (Cross-site scripting) attacks.
imanish003
force-pushed
the
refactor/escape-all-values
branch
from
03d4b41 to
9f4f46a
Compare
rubikuserbot
requested review from
a team and
Aljullu
and removed request for
a team
Aljullu
approved these changes
Dec 1, 2022
Co-authored-by: Albert Juhé Lluveras <[email protected]>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR escape values before rendering.
Whenever we’re rendering data, we should properly escape it. Escaping output prevents XSS (Cross-site scripting) attacks.
Thanks to @Aljullu for suggesting this change in this comment. 🙏🏻
For more info about escaping values, check this doc: https://developer.wordpress.org/plugins/security/securing-output/
I also fixed one minor issue in
StyleAttributesUtils.phpfile related to padding calculation.Testing
This PR touches many atomic block files, so we will need to test these atomic blocks. Here is the list of atomic blocks:
Not much changed for the following blocks, but you can do little bit testing for these blocks too:
WooCommerce Visibility