feat(security): sanitize HTML and JSON to prevent XSS

Ensure `compiled_html` and JSON data are sanitized using `wp_kses_post` to block potentially unsafe inputs. Added filtering for "javascript:" schemes and inline event handlers to mitigate XSS vulnerabilities.
ThemeFuse · Dec 12, 2024 · 684ec5d · 684ec5d
1 parent 50c8580
commit 684ec5d
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/editor/post.php b/editor/post.php
@@ -411,6 +411,11 @@ public function get_compiled_html()
     public function set_compiled_html($compiled_html)
     {
         $compiled_html = Brizy_SiteUrlReplacer::hideSiteUrl($compiled_html);
+
+        if ( !current_user_can( 'unfiltered_html' ) ) {
+			$compiled_html = wp_kses_post($compiled_html);
+		}
+
         $this->compiled_html = $compiled_html;
         return $this;
     }

diff --git a/editor/trait/sanitize.php b/editor/trait/sanitize.php
@@ -15,10 +15,12 @@ public function sanitizeJson( $data ) {
 
 			return $styles;
 		} );
+
 		$dataDecoded = wp_kses_post_deep( $dataDecoded );
 		//$dataDecoded = $this->escapeJsonValues( $dataDecoded );
 		$data = json_encode( $dataDecoded );
 		$data = preg_replace( '/javascript:.*?"/', '"', $data );
+		$data = preg_replace( '/javascript%3A.*?%22/', '%22', $data );
 		$data = preg_replace( '/(on(click|mouseover|keydown|keyup|change|submit|load|error|focus|blur|select|dblclick))\s*[:=]\s*(\\\"|\\\')(.*?)(\3)/i', '', $data );
 
 		return $data;