From 4d616c66653bdf03f671d4837b1811bb52c2ecc2 Mon Sep 17 00:00:00 2001
From: Peter Wilson <peterwilsoncc@git.wordpress.org>
Date: Tue, 13 Jul 2021 05:57:04 +0000
Subject: [PATCH] Widgets: Validate HTML before saving block widgets.

Props talldanwp, noisysocks, kevin940726, peterwilsoncc.


git-svn-id: https://develop.svn.wordpress.org/trunk@51414 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/class-wp-customize-widgets.php    | 7 +++++++
 src/wp-includes/widgets/class-wp-widget-block.php | 9 +++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/class-wp-customize-widgets.php b/src/wp-includes/class-wp-customize-widgets.php
index c1ed9c8e90..d5cae766b9 100644
--- a/src/wp-includes/class-wp-customize-widgets.php
+++ b/src/wp-includes/class-wp-customize-widgets.php
@@ -1419,6 +1419,13 @@ final class WP_Customize_Widgets {
 		if ( isset( $value['raw_instance'] ) && $id_base && wp_use_widgets_block_editor() ) {
 			$widget_object = $wp_widget_factory->get_widget_object( $id_base );
 			if ( ! empty( $widget_object->widget_options['show_instance_in_rest'] ) ) {
+				if ( 'block' === $id_base && ! current_user_can( 'unfiltered_html' ) ) {
+					// The content of the 'block' widget is not filtered on the
+					// fly while editing. Filter the content here to prevent
+					// vulnerabilities.
+					$value['raw_instance']['content'] = wp_kses_post( $value['raw_instance']['content'] );
+				}
+
 				return $value['raw_instance'];
 			}
 		}
diff --git a/src/wp-includes/widgets/class-wp-widget-block.php b/src/wp-includes/widgets/class-wp-widget-block.php
index 8d322ef4e7..bf63359e21 100644
--- a/src/wp-includes/widgets/class-wp-widget-block.php
+++ b/src/wp-includes/widgets/class-wp-widget-block.php
@@ -178,8 +178,13 @@ class WP_Widget_Block extends WP_Widget {
 	 * @return array Settings to save or bool false to cancel saving.
 	 */
 	public function update( $new_instance, $old_instance ) {
-		$instance            = array_merge( $this->default_instance, $old_instance );
-		$instance['content'] = $new_instance['content'];
+		$instance = array_merge( $this->default_instance, $old_instance );
+
+		if ( current_user_can( 'unfiltered_html' ) ) {
+			$instance['content'] = $new_instance['content'];
+		} else {
+			$instance['content'] = wp_kses_post( $new_instance['content'] );
+		}
 
 		return $instance;
 	}