Closed remcotolsma closed 11 months ago
We currently do not escape gateway integration settings field descriptions:
https://github.com/pronamic/wp-pay-core/blob/8382cc083a42cf8ff5987c9a54bb8b483398b9fa/views/meta-box-gateway-settings.php#L412-L417
The WordPress.org plugin review team is currently stumbling over this:
Discussed with @rvdsteege at @pronamic HQ, we are going to restrict the use of HTML elements and attributes via wp_kses (https://developer.wordpress.org/reference/functions/wp_kses/).
wp_kses
We will look at which HTML elements are currently in use: https://github.com/search?q=org%3Apronamic+%27description%27+path%3AIntegration.php&type=code
HTML is limited to:
[ 'a' => [ 'href' => true, 'target' => true, ], 'br' => [], 'code' => [], ]
We currently do not escape gateway integration settings field descriptions:
https://github.com/pronamic/wp-pay-core/blob/8382cc083a42cf8ff5987c9a54bb8b483398b9fa/views/meta-box-gateway-settings.php#L412-L417
The WordPress.org plugin review team is currently stumbling over this:
Discussed with @rvdsteege at @pronamic HQ, we are going to restrict the use of HTML elements and attributes via
wp_kses
(https://developer.wordpress.org/reference/functions/wp_kses/).We will look at which HTML elements are currently in use: https://github.com/search?q=org%3Apronamic+%27description%27+path%3AIntegration.php&type=code