bleedingdeacons / scrutiny

93%

LAST BUILD ON BRANCH main

branch: SELECT

CHANGE BRANCH

x

• No branch selected
• audit-certification-change
• bump-1.23.18
• bump-1.23.19
• chore/add-dependabot
• chore/ci-semgrep-and-pin-actions
• chore/declare-php-extensions
• chore/dev-tooling-standardisation
• chore/dynamic-phpstan-badge
• chore/fix-github-plugin-uri
• chore/migrate-to-wp-mocks
• chore/phpcs-root-files
• chore/phpstan-level-7
• chore/phpstan-level-8
• chore/phpstan-level6
• chore/phpstan-level6-haslogger-types
• chore/phpstan-level6-iterable-types
• chore/psr12-gate
• chore/readme-phpstan-level6
• chore/release
• chore/release-1.27.1
• chore/release-v1-23-25
• chore/release-v1.26.1
• chore/release-v1.27.0
• chore/release-version-bump
• chore/scheduled-semgrep-scan
• chore/tidy-phpstan-ignores
• chore/use-shared-unity-doubles
• chore/wp-mocks-2.0
• ci/composer-audit
• ci/release-on-merge
• ci/validate-lock
• dependabot/composer/dependencies-3022dae4de
• dependabot/composer/dependencies-e9da279c12
• dependabot/github_actions/actions-02325a8da5
• docs/readme-refresh-test-section
• docs/readme-testing-section
• docs/remove-tests-badge
• docs/tests-badge
• feat/audit-detail-full-prose
• feat/audit-remaining-member-fields
• feat/audit-service-role-assignment
• feat/gdpr-audit-history-field
• feat/help-submenu
• feat/php-84-wp-711
• feat/ship-audit-logger-spy
• feat/track-member-landline-and-preferred-contact
• fix/audit-doc-counts
• fix/build-eol
• fix/docs-version-chip
• fix/help-link-blocked-popup
• fix/idempotent-release-job
• fix/release-push-retry
• fix/rest-policy-body-kses
• main
• protect-responder-certification
• readme-backfill-edit-cap
• readonly-cert-visible-disabled
• release/v1.24.0
• release/v1.25.0
• release/v1.26.0
• test/cover-src-admin
• test/pest-5
• tests/coverage-90
• tests/raise-coverage-to-60

Build # 37153500180

Build Type

push

github

Committed by web-flow

Commit Message

fix: filter the privacy-policy body through kses on the REST routes (#82)

Only the shortcode ran wp_kses_post() over the policy body. The REST
routes served get_field('gdpr-policy') as stored, and an administrator
with unfiltered_html can store anything there. Register drops that body
verbatim into its HTML acceptance email, so a javascript:, data: or
vbscript: link, a <script> block or an on* handler reached a mail
client unfiltered.

PrivacyPolicyFormatter now strips <style> and <script> blocks and runs
wp_kses_post() on the body, so every surface gets the same filtered
HTML. The shortcode's own strip moved there with it; its final kses
pass over body plus metadata stays.

The test bootstrap's wp_kses_post() stand-in is removed in favour of
wp-mocks', which also refuses disallowed URL schemes. The local one
loaded first and would have let a javascript: link through.

Coverage Stats

2200 of 2372 relevant lines covered (92.75%)

8.66 hits per line