[wp-trac] [WordPress Trac] #52894: The wp_sanitize_script_attributes function added in version 5.7 does not escape attributes in some cases.

[WordPress Trac]

#52894: The wp_sanitize_script_attributes function added in version 5.7 does not
escape attributes in some cases.
---------------------------+---------------------
 Reporter:  tmatsuur       |       Owner:  (none)
     Type:  defect (bug)   |      Status:  new
 Priority:  normal         |   Milestone:  5.7.1
Component:  Script Loader  |     Version:  5.7
 Severity:  critical       |  Resolution:
 Keywords:  has-patch      |     Focuses:
---------------------------+---------------------

Comment (by tmatsuur):

 With the patch applied, I added the following code to the theme's
 functions.php.

 {{{
 echo wp_get_script_tag(
 ['>console.log("hello");console.log(\'world\')</script><script' => true ]
 );
 }}}

 The output script tag looks like this, and the quotes appear to be
 converted.

 {{{
 <script
 >console.log("hello");console.log('world')</script><script></script>
 }}}

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/52894#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform