Dashboard Widgets: Sanitize help link hrefs

[retrofox]

What?

Hardens gutenberg_sanitize_widget_help() so each help link href is run through esc_url_raw(), and links whose href does not survive sanitization are dropped along with the malformed ones.

Why?

Widget help notes carry optional links rendered as anchors on the dashboard.

The previous sanitizer only checked that label and href were non-empty, so an href with an unsafe scheme such as javascript: alert(1) passed through untouched and reached the rendered markup.

Passing the href through esc_url_raw() rejects unsafe protocols and normalizes the value before it is stored and rendered.

How?

In lib/experimental/dashboard-widgets/widget-types.php, each link href is now filtered with esc_url_raw().

The link is kept only when the filtered href is non-empty, so unsafe or unparseable URLs are dropped instead of forwarded.

Testing

Automated coverage in phpunit/experimental/widget-types-test.php adds an Unsafe protocol link (javascript:alert(1)) to the sanitizer input and asserts that only the valid link survives.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: retrofox <retrofox@git.wordpress.org>
Co-authored-by: chihsuan <chihsuan@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[chihsuan]

Thanks for tightening this up! The change looks good to me.

I noticed "widget action URLs" could potentially benefit from similar sanitization, but that feels outside the scope of this focused fix and can be followed up separately.

[retrofox]

Yes, let's do it in a follow-up. Thanks for your review.