Changeset 7465

Timestamp:

09/09/2026 07:17:33 AM (2 weeks ago)

Author:

johnjamesjacoby

Message:

Topic Tags: Escape names before template output.

This change hardens all current topic-tag name presentation contexts, including copied template overrides, by applying HTML escaping through the existing getter filter. It preserves extension behavior at the standard filter priority and avoids double-encoding stored entities.

In trunk, for 2.7.

Props faran66.

Location:

trunk

Files:

• CHANGELOG.md (modified) (1 diff)
• src/includes/core/filters.php (modified) (1 diff)
• tests/phpunit/testcases/topics/template/topic-tag.php (modified) (1 diff)

trunk/CHANGELOG.md

@@ -50 +50 @@
 ### Security
 
+- Hardened topic-tag name output with consistent HTML escaping.
 - Prevented topic-tag names from being interpreted as JavaScript in confirmation
   prompts.

trunk/src/includes/core/filters.php

@@ -230 +230 @@
         add_filter( 'bbp_get_topic_content', 'bbp_topic_content_append_revisions',  99,  2 );
 }
+
+// Topic tag output - sanitize
+add_filter( 'bbp_get_topic_tag_name', 'esc_html' );
 
 // Form textarea output - undo the code-trick done pre-save, and sanitize

trunk/tests/phpunit/testcases/topics/template/topic-tag.php

@@ -73 +73 @@
          * @covers ::bbp_topic_tag_name
          * @covers ::bbp_get_topic_tag_name
-         * @todo   Implement test_bbp_get_topic_tag_name().
          */
         public function test_bbp_get_topic_tag_name() {
-                // Remove the following lines when you implement this test.
-                $this->markTestIncomplete(
-                        'This test has not been implemented yet.'
+                $term = wp_insert_term(
+                        'Rock & Roll\'s <tag>',
+                        bbp_get_topic_tag_tax_id(),
+                        array( 'slug' => 'rock-and-roll' )
                 );
+
+                $this->assertFalse( is_wp_error( $term ) );
+                $topic_tag_name = bbp_get_topic_tag_name( 'rock-and-roll' );
+
+                $this->assertSame( 'Rock & Roll's <tag>', $topic_tag_name );
+                $this->assertSame( 'Rock & Roll's <tag>', esc_attr( $topic_tag_name ) );
+
+                $filter = static function() {
+                        return '<img src=x onerror=alert(document.domain)>';
+                };
+
+                add_filter( 'bbp_get_topic_tag_name', $filter, 9 );
+                $topic_tag_name = bbp_get_topic_tag_name( 'rock-and-roll' );
+                remove_filter( 'bbp_get_topic_tag_name', $filter, 9 );
+
+                $this->assertSame( '&lt;img src=x onerror=alert(document.domain)&gt;', $topic_tag_name );
         }