Tweak: Ensure editor HTML attributes are escaped

tomusborne · Dec 18, 2024 · bb0f610 · bb0f610
1 parent d66095c
commit bb0f610
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/src/hoc/withHtmlAttributes.js b/src/hoc/withHtmlAttributes.js
@@ -60,6 +60,16 @@ function shallowEqual( obj1, obj2 ) {
 	return true;
 }
 
+const sanitizeAttributeValue = ( value ) => {
+	// Replace characters like &, <, >, " with their HTML entity equivalents
+	return value
+		.replace( /&/g, '&amp;' )
+		.replace( /</g, '&lt;' )
+		.replace( />/g, '&gt;' )
+		.replace( /"/g, '&quot;' )
+		.replace( /'/g, '&#039;' );
+};
+
 export function withHtmlAttributes( WrappedComponent ) {
 	return ( ( props ) => {
 		const {
@@ -77,6 +87,10 @@ export function withHtmlAttributes( WrappedComponent ) {
 
 		const isSavingPost = useSelect( ( select ) => select( 'core/editor' ).isSavingPost() );
 		const { style = '', href, ...otherAttributes } = htmlAttributes;
+		const escapedAttributes = Object.keys( otherAttributes ).reduce( ( acc, key ) => {
+			acc[ key ] = sanitizeAttributeValue( otherAttributes[ key ] );
+			return acc;
+		}, {} );
 		const [ processedStyle, setProcessedStyle ] = useState( style );
 
 		useEffect( () => {
@@ -111,7 +125,7 @@ export function withHtmlAttributes( WrappedComponent ) {
 			? convertInlineStyleStringToObject( processedStyle )
 			: '';
 		const combinedAttributes = {
-			...otherAttributes,
+			...escapedAttributes,
 			style: inlineStyleObject,
 			'data-gb-id': uniqueId,
 			'data-context-post-id': context?.postId ?? context?.[ 'generateblocks/loopIndex' ] ?? 0,