Merge pull request #76 from brainstormforce/security-fix

AST-5003 - Astra Widget Security Issue.

Author: yssambare12

README.md

@@ -5,7 +5,7 @@
 **Requires at least:** 4.7
 **Tested up to:** 6.9
 **Requires PHP:** 5.2
-**Stable tag:** 1.2.16
+**Stable tag:** 1.2.17
 **License:** GPLv2 or later
 **License URI:** http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -75,6 +75,9 @@ In your WordPress admin dashboard go to Appearance -> Widgets, drag the Astra :
 3. Navigate to Appearance -> Widgets to access the widgets available from the plugin.
 
 ## Changelog ##
+### 1.2.17 ###
+- Improved codebase for improved security. (Props to Patchstack)
+
 ### 1.2.16 ###
 - Improved codebase for improved security. (Props to Patchstack)
 

astra-widgets.php

@@ -3,7 +3,7 @@
  * Plugin Name: Astra Widgets
  * Plugin URI: https://wpastra.com/
  * Description: The Fastest Way to Add More Widgets into Your WordPress Website.
- * Version: 1.2.16
+ * Version: 1.2.17
  * Author: Brainstorm Force
  * Author URI: https://www.brainstormforce.com
  * Text Domain: astra-widgets

classes/widgets/class-astra-widget-address.php

@@ -148,7 +148,7 @@ public function widget( $args, $instance ) {
 									<svg xmlns="http://www.w3.org/2000/svg" class="address-icons" width="<?php echo esc_attr( $widget_content_font_size ) . 'px'; ?>" height="<?php echo esc_attr( $widget_content_font_size ) . 'px'; ?>" viewBox="0 0 496 512"><path d="M336.5 160C322 70.7 287.8 8 248 8s-74 62.7-88.5 152h177zM152 256c0 22.2 1.2 43.5 3.3 64h185.3c2.1-20.5 3.3-41.8 3.3-64s-1.2-43.5-3.3-64H155.3c-2.1 20.5-3.3 41.8-3.3 64zm324.7-96c-28.6-67.9-86.5-120.4-158-141.6 24.4 33.8 41.2 84.7 50 141.6h108zM177.2 18.4C105.8 39.6 47.8 92.1 19.3 160h108c8.7-56.9 25.5-107.8 49.9-141.6zM487.4 192H372.7c2.1 21 3.3 42.5 3.3 64s-1.2 43-3.3 64h114.6c5.5-20.5 8.6-41.8 8.6-64s-3.1-43.5-8.5-64zM120 256c0-21.5 1.2-43 3.3-64H8.6C3.2 212.5 0 233.8 0 256s3.2 43.5 8.6 64h114.6c-2-21-3.2-42.5-3.2-64zm39.5 96c14.5 89.3 48.7 152 88.5 152s74-62.7 88.5-152h-177zm159.3 141.6c71.4-21.2 129.4-73.7 158-141.6h-108c-8.8 56.9-25.6 107.8-50 141.6zM19.3 352c28.6 67.9 86.5 120.4 158 141.6-24.4-33.8-41.2-84.7-50-141.6h-108z"></path>
 									</svg>
 							<?php } ?>
-							<span class="address-meta"><?php echo nl2br( $address ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></span>
+							<span class="address-meta"><?php echo nl2br( esc_html( $address ) ); ?></span>
 						</div>
 					<?php } ?>
 					<?php if ( ! empty( $phone ) ) { ?>
@@ -167,7 +167,7 @@ public function widget( $args, $instance ) {
 
 							?>
 							<span class="address-meta">
-								<a href="tel:<?php echo esc_attr( $prefix ) . esc_attr( preg_replace( '/\D/', '', esc_attr( $phone ) ) ); ?>" ><?php echo esc_html( $phone ); ?></a>
+								<a href="<?php echo esc_url( 'tel:' . $prefix . preg_replace( '/\D/', '', $phone ) ); ?>" ><?php echo esc_html( $phone ); ?></a>
 							</span>
 						</div>
 					<?php } ?>
@@ -178,7 +178,7 @@ public function widget( $args, $instance ) {
 									<svg xmlns="http://www.w3.org/2000/svg" class="address-icons" width="<?php echo esc_attr( $widget_content_font_size ) . 'px'; ?>" height="<?php echo esc_attr( $widget_content_font_size ) . 'px'; ?>" viewBox="0 0 384 512"><path d="M224 136V0H24C10.7 0 0 10.7 0 24v464c0 13.3 10.7 24 24 24h336c13.3 0 24-10.7 24-24V160H248c-13.2 0-24-10.8-24-24zm160-14.1v6.1H256V0h6.1c6.4 0 12.5 2.5 17 7l97.9 98c4.5 4.5 7 10.6 7 16.9z"></path>
 									</svg>
 							<?php } ?>
-							<span class="address-meta"><?php echo esc_attr( $fax ); ?></span>
+							<span class="address-meta"><?php echo esc_html( $fax ); ?></span>
 						</div>
 					<?php } ?>
 					<?php
@@ -192,7 +192,7 @@ public function widget( $args, $instance ) {
 									</svg>
 							<?php } ?>
 							<span class="address-meta">
-								<a href="mailto:<?php echo esc_attr( antispambot( $email ) ); ?>" ><?php echo esc_html( antispambot( $email ) ); ?></a>
+								<a href="<?php echo esc_url( 'mailto:' . antispambot( $email ) ); ?>" ><?php echo esc_html( antispambot( $email ) ); ?></a>
 							</span>
 						</div>
 					<?php } ?>

classes/widgets/class-astra-widget-list-icons.php

@@ -249,6 +249,10 @@ public function update( $new_instance, $old_instance ) {
 				} else {
 					foreach ( $instance['list'] as $key => $value ) {
 						$instance['list'][ $key ] = array_map( 'sanitize_text_field', $value );
+						// Sanitize link field specifically to prevent XSS attacks.
+						if ( isset( $value['link'] ) ) {
+							$instance['list'][ $key ]['link'] = esc_url_raw( $value['link'] );
+						}
 					}
 				}
 			}

classes/widgets/class-astra-widget-social-profiles.php

@@ -347,7 +347,7 @@ public function widget( $args, $instance ) {
 							$trimmed = str_replace( 'astra-icon-', '', $list['icon'] );
 							?>
 							<li>
-								<a href="<?php echo isset( $list['link'] ) ? esc_attr( $list['link'] ) : '#'; ?>" target="<?php echo esc_attr( $target ); ?>" rel="<?php echo esc_attr( $rel ); ?>" aria-label="<?php echo ( is_object( $list_data ) ) ? esc_html( $list_data->name ) : ''; ?>">
+								<a href="<?php echo isset( $list['link'] ) ? esc_url( $list['link'] ) : '#'; ?>" target="<?php echo esc_attr( $target ); ?>" rel="<?php echo esc_attr( $rel ); ?>" aria-label="<?php echo ( is_object( $list_data ) ) ? esc_html( $list_data->name ) : ''; ?>">
 										<span class="ast-widget-icon <?php echo ( is_object( $list_data ) ) ? esc_html( $list_data->name ) : ''; ?>">
 											<?php if ( ! empty( $list_data->viewbox ) && ! empty( $list_data->path ) ) { ?>
 												<svg xmlns="http://www.w3.org/2000/svg" viewBox="<?php echo ( isset( $list_data->viewbox ) ) ? esc_attr( $list_data->viewbox ) : ''; ?>" width="<?php echo esc_attr( $icon_width ); ?>" height="<?php echo esc_attr( $icon_width ); ?>"><path d="<?php echo ( isset( $list_data->path ) ) ? esc_attr( $list_data->path ) : ''; ?>"></path></svg>
@@ -388,6 +388,17 @@ public function update( $new_instance, $old_instance ) {
 			 */
 			$instance['display-title'] = isset( $new_instance['display-title'] ) ? (bool) $new_instance['display-title'] : false;
 
+			/**
+			 * Sanitize social profile links to prevent XSS attacks.
+			 */
+			if ( isset( $instance['list'] ) && is_array( $instance['list'] ) ) {
+				foreach ( $instance['list'] as $key => $profile ) {
+					if ( isset( $profile['link'] ) ) {
+						$instance['list'][ $key ]['link'] = esc_url_raw( $profile['link'] );
+					}
+				}
+			}
+
 			/**
 			 * Created new widget meta option to resolve repeater fields not appearing in block editor widgets.
 			 *

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "astra-widgets",
-  "version": "1.2.16",
+  "version": "1.2.17",
   "description": "[![pipeline status](http://git.brainstormforce.com/astra/astra-widgets/badges/master/pipeline.svg)](http://git.brainstormforce.com/astra/astra-widgets/commits/master)",
   "main": "Gruntfile.js",
   "scripts": {

package.json

@@ -5,7 +5,7 @@ Tags: Address widget, Social profile widget, List icon widget, Social media, Add
 Requires at least: 4.7
 Tested up to: 6.9
 Requires PHP: 5.2
-Stable tag: 1.2.16
+Stable tag: 1.2.17
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -76,6 +76,9 @@ In your WordPress admin dashboard go to Appearance -> Widgets, drag the Astra :
 
 == Changelog ==
 
+= 1.2.17 =
+- Improved codebase for improved security. (Props to Patchstack.).
+
 = 1.2.16 =
 - Improved codebase for improved security. (Props to Patchstack.).