From 239471ade4ef2340f52251363d17b198f7a976aa Mon Sep 17 00:00:00 2001
From: Ian Dunn <iandunn@git.wordpress.org>
Date: Sat, 12 May 2018 15:55:36 +0000
Subject: [PATCH] Privacy: Escape comment URLs in personal export file to
 prevent XSS.

There doesn't appear to be any way for an attacker to introduce malicious input into the URL, unless a plugin is filtering the URL to add it, but it's better to be safe than sorry.

Props birgire.
Fixes #44054.


git-svn-id: https://develop.svn.wordpress.org/trunk@43245 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/comment.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/wp-includes/comment.php b/src/wp-includes/comment.php
index 41a1dc3f9f..4c78eb9b6a 100644
--- a/src/wp-includes/comment.php
+++ b/src/wp-includes/comment.php
@@ -3353,7 +3353,11 @@ function wp_comments_personal_data_exporter( $email_address, $page = 1 ) {
 
 				case 'comment_link':
 					$value = get_comment_link( $comment->comment_ID );
-					$value = '<a href="' . $value . '" target="_blank" rel="noreferrer noopener">' . $value . '</a>';
+					$value = sprintf(
+						'<a href="%s" target="_blank" rel="noreferrer noopener">%s</a>',
+						esc_url( $value ),
+						esc_html( $value )
+					);
 					break;
 			}