3.16 - Secure LCP/ATF data from the AJAX endpoint and DB about wp-rocket HOT 2 CLOSED

Scope a solution ✅

Engine\Media\AboveTheFold\AJAX\Controller

in add_lcp_data()

• use esc_url_raw() on the lcp/viewport src values
• update tests

Engine\Media\AboveTheFold\Frontend\Controller

in generate_lcp_link_tag_with_sources()

• use esc_url() for the src values in the href
• update tests

For the long date for LCP/ATF, I'm not sure how we could limit by character. The string is generated using JSON encoding of an object, so we can't truncate the string itself (it would be malformed).

Estimate the effort ✅

Effort [S]

from wp-rocket.

Looks good to me

from wp-rocket.