Media: Consistently escape URLs in attachment download links and JS data.

The "Download file" link in `attachment_submitbox_metadata()` escaped its `href` with `esc_attr()`, which only HTML-encodes the value. Use `esc_url()` instead, the correct function for a URL in an `href` attribute, since `$att_url` comes from `wp_get_attachment_url()`. This applies the same escaping method for the Download link in the media list table output by `WP_Media_List_Table::_get_row_actions()`.

Apply the same correction to `wp_prepare_attachment_for_js()`, wrapping the attachment, intermediate size, full-size, original image, and image source URLs in `esc_url_raw()` so the Backbone-rendered media UI emits URLs filtered through `clean_url` just like the server-rendered templates.

Developed in WordPress#12062.
Follow-up to r21680, r47202, r55156, r55198, r55221.

Props thisismyurl, westonruter, sabernhardt, gazipress, jamesbregenzer, manhar, sanayasir, freewebmentor.
See #57574, #41474.
Fixes #65397.


git-svn-id: https://develop.svn.wordpress.org/trunk@62494 602fd350-edb4-49c9-b593-d223f7449a82

Author: westonruter

src/wp-admin/includes/media.php

@@ -3387,7 +3387,7 @@ function attachment_submitbox_metadata() {
 		</span>
 	</div>
 	<div class="misc-pub-section misc-pub-download">
-		<a href="<?php echo esc_attr( $att_url ); ?>" download><?php _e( 'Download file' ); ?></a>
+		<a href="<?php echo esc_url( $att_url ); ?>" download><?php _e( 'Download file' ); ?></a>
 	</div>
 	<div class="misc-pub-section misc-pub-filename">
 		<?php _e( 'File name:' ); ?> <strong><?php echo $filename; ?></strong>

src/wp-includes/media.php

@@ -4573,7 +4573,7 @@ function wp_prepare_attachment_for_js( $attachment ) {
 		'id'            => $attachment->ID,
 		'title'         => $attachment->post_title,
 		'filename'      => wp_basename( get_attached_file( $attachment->ID ) ),
-		'url'           => $attachment_url,
+		'url'           => esc_url_raw( $attachment_url ),
 		'link'          => get_attachment_link( $attachment->ID ),
 		'alt'           => get_post_meta( $attachment->ID, '_wp_attachment_image_alt', true ),
 		'author'        => $attachment->post_author,
@@ -4679,7 +4679,7 @@ function wp_prepare_attachment_for_js( $attachment ) {
 				$sizes[ $size ] = array(
 					'height'      => $downsize[2],
 					'width'       => $downsize[1],
-					'url'         => $downsize[0],
+					'url'         => esc_url_raw( $downsize[0] ),
 					'orientation' => $downsize[2] > $downsize[1] ? 'portrait' : 'landscape',
 				);
 			} elseif ( isset( $meta['sizes'][ $size ] ) ) {
@@ -4695,19 +4695,20 @@ function wp_prepare_attachment_for_js( $attachment ) {
 				$sizes[ $size ] = array(
 					'height'      => $height,
 					'width'       => $width,
-					'url'         => $base_url . $size_meta['file'],
+					'url'         => esc_url_raw( $base_url . $size_meta['file'] ),
 					'orientation' => $height > $width ? 'portrait' : 'landscape',
 				);
 			}
 		}
 
 		if ( 'image' === $type ) {
 			if ( ! empty( $meta['original_image'] ) ) {
-				$response['originalImageURL']  = wp_get_original_image_url( $attachment->ID );
+				$original_image_url            = wp_get_original_image_url( $attachment->ID );
+				$response['originalImageURL']  = $original_image_url ? esc_url_raw( $original_image_url ) : '';
 				$response['originalImageName'] = wp_basename( wp_get_original_image_path( $attachment->ID ) );
 			}
 
-			$sizes['full'] = array( 'url' => $attachment_url );
+			$sizes['full'] = array( 'url' => esc_url_raw( $attachment_url ) );
 
 			if ( isset( $meta['height'], $meta['width'] ) ) {
 				$sizes['full']['height']      = $meta['height'];
@@ -4718,7 +4719,7 @@ function wp_prepare_attachment_for_js( $attachment ) {
 			$response = array_merge( $response, $sizes['full'] );
 		} elseif ( $meta['sizes']['full']['file'] ) {
 			$sizes['full'] = array(
-				'url'         => $base_url . $meta['sizes']['full']['file'],
+				'url'         => esc_url_raw( $base_url . $meta['sizes']['full']['file'] ),
 				'height'      => $meta['sizes']['full']['height'],
 				'width'       => $meta['sizes']['full']['width'],
 				'orientation' => $meta['sizes']['full']['height'] > $meta['sizes']['full']['width'] ? 'portrait' : 'landscape',
@@ -4757,7 +4758,7 @@ function wp_prepare_attachment_for_js( $attachment ) {
 			$response_image_full = wp_get_attachment_image_src( $id, 'full' );
 			if ( is_array( $response_image_full ) ) {
 				$response['image'] = array(
-					'src'    => $response_image_full[0],
+					'src'    => esc_url_raw( $response_image_full[0] ),
 					'width'  => $response_image_full[1],
 					'height' => $response_image_full[2],
 				);
@@ -4766,7 +4767,7 @@ function wp_prepare_attachment_for_js( $attachment ) {
 			$response_image_thumb = wp_get_attachment_image_src( $id, 'thumbnail' );
 			if ( is_array( $response_image_thumb ) ) {
 				$response['thumb'] = array(
-					'src'    => $response_image_thumb[0],
+					'src'    => esc_url_raw( $response_image_thumb[0] ),
 					'width'  => $response_image_thumb[1],
 					'height' => $response_image_thumb[2],
 				);