Escaping Sniff traits

[alanef]

What are the 'rules' for being in auto Escaped function in the trait

private $autoEscapedFunctions = array(

I'm asking as wp_nonce_url is a non plugable, non filterable core function that returns escaped html

If it is valid to add - I'm happy to have a go at a trivial pull request

[dingo-d]

Don't think there are any specific rules. If you find a function that is missing from the list, but you think it's ok to be added you can make a PR for it 🙂

From the looks of it, the above-mentioned function should be on the list, as its output is escaped with esc_html 👍🏼

[jrfnl]

Just had a quick look at the function, but I wonder whether the escaping with esc_html() is actually correct/sufficient. I would expect the URL to be used in most cases in an HTML attribute, like <form action="..."> or <a href="...">, in which case the URL should be escaped using esc_url(), not esc_html().

I think this may need discussion on Trac and potentially a fix in WP Core first.

https://developer.wordpress.org/reference/functions/wp_nonce_url/

[alanef]

looking at the since tags wp_nonce_url was introduced 2.0.4 but esc_url not until 2.8.0 which would explain a bit.

Using esc_html is not wrong ( in a security context ) as such it just misses out on properly encoding html in use in in a url string such as in a query arg, but as the nonce url doesn't need this then it is a bit of a mute point.