search

pronamic / wp-pay-core

Core components for the WordPress payment processing library. This library is used in the WordPress plugin Pronamic Pay: https://www.pronamicpay.com/, but also allows other plugin developers to set up a payment plugin.
https://www.wp-pay.org/
GNU General Public License v3.0
27 stars 3 forks source link

Payment gateway integration settings field description output not escaped #150

Closed remcotolsma closed 11 months ago

remcotolsma commented 11 months ago

We currently do not escape gateway integration settings field descriptions:

https://github.com/pronamic/wp-pay-core/blob/8382cc083a42cf8ff5987c9a54bb8b483398b9fa/views/meta-box-gateway-settings.php#L412-L417

The WordPress.org plugin review team is currently stumbling over this:

Discussed with @rvdsteege at @pronamic HQ, we are going to restrict the use of HTML elements and attributes via wp_kses (https://developer.wordpress.org/reference/functions/wp_kses/).

We will look at which HTML elements are currently in use: https://github.com/search?q=org%3Apronamic+%27description%27+path%3AIntegration.php&type=code

remcotolsma commented 11 months ago

HTML is limited to:

[
    'a'    => [
        'href'   => true,
        'target' => true,
    ],
    'br'   => [],
    'code' => [],
]