From 63cc2673a1ed60e9f23f9267cc011c987c452111 Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Wed, 29 Nov 2017 16:33:54 +0000 Subject: [PATCH] Hardening: Add escaping to the language attributes used on `html` elements. Merges [42259] to the 4.2 branch. Built from https://develop.svn.wordpress.org/branches/4.2@42293 git-svn-id: http://core.svn.wordpress.org/branches/4.2@42122 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/general-template.php | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/wp-includes/general-template.php b/wp-includes/general-template.php index f9a529f069..af2dedf7ff 100644 --- a/wp-includes/general-template.php +++ b/wp-includes/general-template.php @@ -2522,12 +2522,14 @@ function language_attributes($doctype = 'html') { if ( function_exists( 'is_rtl' ) && is_rtl() ) $attributes[] = 'dir="rtl"'; - if ( $lang = get_bloginfo('language') ) { - if ( get_option('html_type') == 'text/html' || $doctype == 'html' ) - $attributes[] = "lang=\"$lang\""; + if ( $lang = get_bloginfo( 'language' ) ) { + if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) { + $attributes[] = 'lang="' . esc_attr( $lang ) . '"'; + } - if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' ) - $attributes[] = "xml:lang=\"$lang\""; + if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) { + $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"'; + } } $output = implode(' ', $attributes);