Escaped backreferences to prevent XSS

[girishpanchal30]

Summary:

The 4.2.3 fix for CVE-2026-5217 escaped the srcset descriptor with esc_attr(), but the escaped value is then passed as the replacement argument of preg_replace(), which still expands $0/$1 backreferences and can reinsert a raw double quote to break out of the attribute. Escape $ and \ with addcslashes() right before each preg_replace() call in add_missing_srcset_attributes(), enhance_existing_srcset(), and enhance_existing_sizes().

All Submissions:

• Have you followed the Optimole Contributing guideline?
• Does your code follow the WordPress' coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Closes https://github.com/Codeinwp/optimole-service/issues/1780

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully ran tests with your changes locally?

[pirate-bot]

Plugin build for 87f97b7 is ready 🛎️!

• Download build
• Download dev

[Copilot]

🟡 Changes recommended

Tests do not cover backslash-form backreferences or the slashed-output path targeted by the fix.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Prevents preg_replace() backreference expansion from reintroducing unsafe content into responsive image attributes.

Changes:

• Escapes replacement-sensitive $ and \ characters.
• Adds XSS regression tests for affected srcset and sizes paths.

File summaries

File	Description
inc/tag_replacer.php	Secures attribute replacement strings.
tests/test-srcset.php	Adds backreference-injection tests.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The replacement values are correctly escaped immediately before use, with focused regression coverage.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[pirate-bot]

🤖 Review agent — review posted ✅

• Review: APPROVED · 0 findings
• Head: 87f97b7
• Duration: 15 min 04 s

Run code-review-agent_6a9fe7ae670439.09386836 · trail

[pirate-bot]

Approved: The escaping blocks backreference expansion and preserves slashed output.

All eight focused regression tests passed on PHP 8.3.

Validation details

• PHP 8.3, WordPress 7.1, and PHPUnit 9.6.22 passed eight tests with 20 assertions.
• Static tracing connected descriptor data to both changed srcset sinks.
• The trust-boundary pass found no changed-code security defect.

Untested areas

• Full suites, linters, and builds remain for CI.
• The planner returned no plan because its test hunk was abbreviated.

🤖 Automated review · run code-review-agent_6a9fe7ae670439.09386836.

[pirate-bot]

🎉 This PR is included in version 4.2.12 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀