Use esc_url() when constructing the href for the post-title block (#…

…53981)
WordPress · Oct 2, 2023 · d2e6ed6 · d2e6ed6 · github-actions · Oct 2, 2023
1 parent 1187fe6
commit d2e6ed6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/block-library/src/post-title/index.php b/packages/block-library/src/post-title/index.php
@@ -38,7 +38,7 @@ function render_block_core_post_title( $attributes, $content, $block ) {
 
 	if ( isset( $attributes['isLink'] ) && $attributes['isLink'] ) {
 		$rel   = ! empty( $attributes['rel'] ) ? 'rel="' . esc_attr( $attributes['rel'] ) . '"' : '';
-		$title = sprintf( '<a href="%1$s" target="%2$s" %3$s>%4$s</a>', get_the_permalink( $block->context['postId'] ), esc_attr( $attributes['linkTarget'] ), $rel, $title );
+		$title = sprintf( '<a href="%1$s" target="%2$s" %3$s>%4$s</a>', esc_url( get_the_permalink( $block->context['postId'] ) ), esc_attr( $attributes['linkTarget'] ), $rel, $title );
 	}
 
 	$classes = array();