diff --git a/inc/render/class-form-multiple-choice.php b/inc/render/class-form-multiple-choice.php index ca3cc7cd2..8dac5affa 100644 --- a/inc/render/class-form-multiple-choice.php +++ b/inc/render/class-form-multiple-choice.php @@ -89,7 +89,28 @@ public function render_field( $type, $label, $value, $name, $id, $checked = fals $output = '
'; $output .= ''; - $output .= ''; + + $allowed_tags = array( + 'a' => array( + 'href' => true, + 'target' => true, + ), + 'img' => array( + 'src' => true, + 'alt' => true, + 'width' => true, + 'height' => true, + ), + 'span' => array(), + 'em' => array(), + 'strong' => array(), + 'i' => array(), + 'b' => array(), + ); + + $label = wp_kses( $label, $allowed_tags ); + + $output .= ''; $output .= '
'; diff --git a/tests/test-choices-field-block.php b/tests/test-choices-field-block.php new file mode 100644 index 000000000..aa7e50445 --- /dev/null +++ b/tests/test-choices-field-block.php @@ -0,0 +1,37 @@ +'; + $expected .= ''; + $expected .= ''; + $expected .= ''; + + $output = $block_render->render_field( 'checkbox', 'Option with link', 'otter-blocks', 'otter-blocks', 'otter-blocks' ); + + $this->assertEquals( $expected, $output ); + + $malicious_label = 'Option with link'; + $output = $block_render->render_field( 'checkbox', $malicious_label, 'otter-blocks', 'otter-blocks', 'otter-blocks' ); + + $this->assertEquals( $expected, $output ); + + $malicious_label = 'Option with link'; + $output = $block_render->render_field( 'checkbox', $malicious_label, 'otter-blocks', 'otter-blocks', 'otter-blocks' ); + + $this->assertEquals( $expected, $output ); + } +}