| @@ -7,8 +7,11 @@ | ||
| 7 | 7 | echo $wrapper_attr; //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>> |
| 8 | 8 | <div class="betterdocs-article-reactions-sidebar"> |
| 9 | 9 | <?php |
| 10 | 10 | $text_tag = isset( $text_tag ) ? $text_tag : 'h5'; |
| 11 | + // Allow-list the tag name — esc_attr() does not stop a space/= from | |
| 12 | + // injecting an attribute in this tag-name position (stored XSS). | |
| 13 | + $text_tag = betterdocs()->template_helper->is_valid_tag( $text_tag ); | |
| 11 | 14 | echo wp_sprintf( '<%1$s class="betterdocs-reactions-title-tag">%2$s</%1$s>', esc_attr( $text_tag ), esc_html( $reactions_text ) ); |
| 12 | 15 | ?> |
| 13 | 16 | <ul class="betterdocs-article-reaction-links layout-3"> |
| 14 | 17 | <?php if ( isset( $happy ) && $happy == true ) { ?> |
