From c27cc8b694cdd7b2937bcc1b90257f7c6d0ddc8c Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov@git.wordpress.org>
Date: Fri, 1 Apr 2022 11:44:59 +0000
Subject: [PATCH] Administration: Consistently escape icon URLs in the admin
 menu.

Follow-up to [9154], [26664].

Props chintan1896, jigar-bhanushali, mukesh27.
Fixes #55496.

git-svn-id: https://develop.svn.wordpress.org/trunk@53050 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/menu-header.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wp-admin/menu-header.php b/src/wp-admin/menu-header.php
index 1f481f8634..db13845c97 100644
--- a/src/wp-admin/menu-header.php
+++ b/src/wp-admin/menu-header.php
@@ -123,13 +123,13 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
 		 * as special cases.
 		 */
 		if ( ! empty( $item[6] ) ) {
-			$img = '<img src="' . $item[6] . '" alt="" />';
+			$img = '<img src="' . esc_url( $item[6] ) . '" alt="" />';
 
 			if ( 'none' === $item[6] || 'div' === $item[6] ) {
 				$img = '<br />';
 			} elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) {
 				$img       = '<br />';
-				$img_style = ' style="background-image:url(\'' . esc_attr( $item[6] ) . '\')"';
+				$img_style = ' style="background-image:url(\'' . esc_url( $item[6] ) . '\')"';
 				$img_class = ' svg';
 			} elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) {
 				$img       = '<br />';