Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: StoredNodeGuard keeps plain relative links copyable (P18)

Browse Source 
A link without scheme and without whitespace, quotes, <, >, backslashes or
control characters passes although esc_url_raw() would prefix http://; every
value with a scheme, and protocol-relative //host, must survive url() unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
janniclas.loosen
2026-09-27 01:58:47 +02:00
co-authored by Claude Opus 5.5
parent e808832fd3
commit 16c6d59725
2 changed files with 123 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Divi/Compose/StoredNodeGuard.php
+18 -3
View File
@@ -29,8 +29,8 @@ defined('ABSPATH') || exit;
* also when the builder-only key sits below the state value,
* - a string with control characters (S32), rich text or code that the sanitizer would change
* (not kses-stable), a plain-text string with markup that is not kses-stable, a URL the
* sanitizer would change, or a key inside a value that is no plain identifier (S13) – routed
* exactly like ValueCleaner (kindAt(), VALUE_KEY),
* sanitizer would change (plain relative links excepted, ruling P18), or a key inside a value
* that is no plain identifier (S13) – routed exactly like ValueCleaner (kindAt(), VALUE_KEY),
* - a $variable(…)$ reference VariableRef::canonical() refuses for the target post, or whose
* settings canonical() would clean (e.g. before/after with markup such a user may not write).
* Users with unfiltered_html may move anything (the same line as the S7 gate). Pure PHP.
@@ -42,6 +42,9 @@ final class StoredNodeGuard
/** An instance's globalModule: the library post ID, digits only (GlobalInstance::of()). */
private const LIBRARY_ID = '/^[1-9][0-9]*$/D';
/** P18: no scheme before the first "/", "?" or "#"; no whitespace, quotes, <, >, backslash or controls. */
private const RELATIVE_URL = '~^[^:/?#\s"\'<>\\\\\x00-\x1F\x7F]*(?:[/?#][^\s"\'<>\\\\\x00-\x1F\x7F]*)?$~D';
private const BUILDER_ONLY = 'nur im Divi-Builder übertragbar (oder mit dem Recht unfiltered_html)';
public function __construct(
@@ -247,13 +250,25 @@ final class StoredNodeGuard
ValueKind::Html => $this->sanitizer->html($value) === $value,
ValueKind::Code => $this->sanitizer->code($value) === $value,
ValueKind::Text => ! str_contains($value, '<') || $this->sanitizer->html($value) === $value,
ValueKind::Url => $this->sanitizer->url($value) === trim($value),
ValueKind::Url => $this->sanitizer->url($value) === trim($value) || self::isPlainRelativeUrl($value),
};
return $stable ? null : 'Inhalt, den dieses Konto so nicht schreiben darf (HTML, Skript oder Link) – '
. self::BUILDER_ONLY . '.';
}
/**
* Ruling P18: a link without scheme – nothing before the first "/", "?" or "#" contains ":" – and
* without whitespace, quotes, "<", ">", backslashes or control characters ("kontakt/", "/pfad",
* "#anker", "?q=1"). esc_url_raw() would prefix "http://" to some of them, yet they cannot carry
* javascript: or data:. Protocol-relative "//host" (and "\\host", which browsers read the same)
* does not count: it must survive url() unchanged.
*/
private static function isPlainRelativeUrl(string $value): bool
{
return preg_match(self::RELATIVE_URL, $value) === 1 && ! str_starts_with($value, '//');
}
/** Same check as a client reference (VariableRef::canonical()); refused when cleaning would change it. */
private function referenceProblem(string $value, bool $url): ?string
{