fix: esc

Author: abdul-kaioum

backend/app/Providers/AccessControlProvider.php

@@ -218,7 +218,7 @@ public function scanFile($command, $args)
         }
 
         if (\count($this->scannedResult) > 0) {
-            throw new PreCommandException(wp_strip_all_tags(implode('. >> ', $this->scannedResult)));
+            throw new PreCommandException(esc_html(implode('. >> ', $this->scannedResult)));
         }
     }
 

backend/app/Providers/FileEditValidator.php

@@ -41,7 +41,7 @@ public function checkSyntax($content, $realFile)
         if ($wpError instanceof WP_Error) {
             $message = $wpError->get_error_message();
 
-            throw new PreCommandException(wp_strip_all_tags($message));
+            throw new PreCommandException(esc_html($message));
         }
     }
 

backend/app/Providers/PhpSyntaxChecker.php

@@ -91,7 +91,8 @@ private function loopbackRequest()
         // Include Basic auth in loopback requests.
         if (isset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])) {
             $headers['Authorization'] = 'Basic ' . base64_encode(
-                wp_unslash($_SERVER['PHP_AUTH_USER']) . ':' . wp_unslash($_SERVER['PHP_AUTH_PW'])
+                // phpcs:disable WordPress.Security.ValidatedSanitizedInput -- We need to sanitize the username, but the password should be left as-is.
+                sanitize_user(wp_unslash($_SERVER['PHP_AUTH_USER'])) . ':' . wp_unslash($_SERVER['PHP_AUTH_PW'])
             );
         }