Privacy: Correctly escape page title in get_the_privacy_policy_link().

Update the escaping of the page title used in `get_the_privacy_policy_link()` to use a sub-set of permitted tags via `wp_kses()` rather than `esc_html()`. 

WordPress permits the use of HTML tags within a page title so `esc_html()` isn't appropriate as it renders the HTML tags with html encoded characters.

Props shailu25, huzaifaalmesbah, mukesh27, hbhalodia, joedolson, masteradhoc, noruzzaman, ozgursar, sabernhardt, westonruter, wildworks.
Fixes #64748.




git-svn-id: https://develop.svn.wordpress.org/trunk@64092 602fd350-edb4-49c9-b593-d223f7449a82

Author: peterwilsoncc

src/wp-includes/link-template.php

@@ -4848,7 +4848,16 @@ function get_the_privacy_policy_link( $before = '', $after = '' ) {
 		$link = sprintf(
 			'<a class="privacy-policy-link" href="%s" rel="privacy-policy">%s</a>',
 			esc_url( $privacy_policy_url ),
-			esc_html( $page_title )
+			wp_kses(
+				$page_title,
+				array(
+					'strong' => array( 'class' => true ),
+					'em'     => array( 'class' => true ),
+					'b'      => array( 'class' => true ),
+					'i'      => array( 'class' => true ),
+					'span'   => array( 'class' => true ),
+				)
+			)
 		);
 	}
 

tests/phpunit/tests/link/getThePrivacyPolicyLink.php

@@ -78,6 +78,42 @@ public function test_get_the_privacy_policy_link_should_return_valid_link_when_p
 		$this->assertStringEndsWith( '>' . WP_TESTS_DOMAIN . ' Privacy Policy</a>', $actual_link );
 	}
 
+	/**
+	 * The function should allow only supported formatting in the privacy policy page title.
+	 *
+	 * Supported tags may include a class attribute; other tags and attributes are stripped.
+	 *
+	 * @ticket 64748
+	 */
+	public function test_get_the_privacy_policy_link_should_allow_supported_title_markup() {
+		$privacy_policy_page_id = self::$privacy_policy_page_id;
+
+		/*
+		 * Run after core `the_title` formatting filters (e.g. wptexturize).
+		 *
+		 * A filter is used rather than updating the post to ensure that the script tag is
+		 * stripped from the output by KSES as intended.
+		 */
+		$filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) {
+			if ( (int) $privacy_policy_page_id === (int) $post_id ) {
+				return '<strong class="privacy">Privacy</strong> <em class="policy">Policy</em> <b class="bold">Bold</b> <i class="italic">Italic</i> <span class="page-title">Page</span> <script>alert("test")</script>';
+			}
+
+			return $title;
+		};
+
+		add_filter( 'the_title', $filter, 20, 2 );
+
+		update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id );
+
+		$actual_link = get_the_privacy_policy_link();
+
+		$this->assertStringEndsWith(
+			'><strong class="privacy">Privacy</strong> <em class="policy">Policy</em> <b class="bold">Bold</b> <i class="italic">Italic</i> <span class="page-title">Page</span> alert("test")</a>',
+			$actual_link
+		);
+	}
+
 	/**
 	 * The function should prepend the supplied `$before` markup and append the
 	 * supplied `$after` markup when the `wp_page_for_privacy_policy` is configured.