Fix: security for unfiltered html cap #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

bfintal merged 16 commits into develop from fix/security

Jan 8, 2026

src/action-types/class-action-type-update-attribute.php

-Original file line number
+Diff line change
@@ Expand Up / @@ -59,6 +59,33 @@ public function initialize() { @@
     			$this->has_easing = false;
     		}
+    		public function is_dangerous_attribute( $attribute_name ) {
+    			if ( empty( $attribute_name ) || ! is_string( $attribute_name ) ) {
+    				return false;
+    			}
+    			$attribute_name = strtolower( trim( $attribute_name ) );
+    			// Event handler attributes (onclick, onerror, onload, etc.)
+    			if ( preg_match( '/^on[a-z]+/', $attribute_name ) ) {
+    				return true;
+    			}
+    			// Attributes that can contain JavaScript URIs or code
+    			$dangerous_attributes = [
+    				'href',
+    				'src',
+    				'action',
+    				'formaction',
+    				// 'style', // Can contain CSS with expression() or javascript: URIs
+    				'form',
+    				'formmethod',
+    				'formtarget',
+    			];
+    			return in_array( $attribute_name, $dangerous_attributes, true );
+    		}
     		public function sanitize_data_for_saving( $value ) {
     			// Sanitize action value: ensure $value is an array and attribute/value are strings.
     			if ( ! is_array( $value ) ) {
@@ Expand Down @@

Provide feedback