From 01f9a20a603a5c9eb748c66cd47aced3160920de Mon Sep 17 00:00:00 2001
From: Matthew Bernhardt <mjbernha@mit.edu>
Date: Fri, 2 Oct 2026 11:27:09 -0400
Subject: [PATCH 1/2] Proof of concept for wp_kses

---
 .../blocks/hero-section/render.php                   | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/web/app/plugins/mitlib-post-hero-images/blocks/hero-section/render.php b/web/app/plugins/mitlib-post-hero-images/blocks/hero-section/render.php
index a7e38afc..eb55e690 100644
--- a/web/app/plugins/mitlib-post-hero-images/blocks/hero-section/render.php
+++ b/web/app/plugins/mitlib-post-hero-images/blocks/hero-section/render.php
@@ -55,6 +55,12 @@
 	$escaped_hero_credit = $escaped_citation;
 }
 
+$allowed_html = array(
+	'a' => array(
+		'href' => array(),
+	),
+);
+
 ?><section id="hero">
 	<div class="hero-bg" role="img" aria-label="<?php echo esc_attr( $hero_alt_text ); ?>" style="background-image: url(<?php echo esc_url( $hero_image_url ); ?>);"></div>
 	<div class="overlay">	
@@ -72,11 +78,7 @@
 			</div>
 			<?php if ( $escaped_hero_credit ) : ?>
 			<span class="hero-image-credit">
-				<?php
-				// phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped -- built from esc_html()/esc_url() pieces above.
-				echo $escaped_hero_credit;
-				// phpcs:enable -- resume normal scanning.
-				?>
+				<?php echo wp_kses( $escaped_hero_credit, $allowed_html ); ?>
 			</span>
 			<?php endif; ?>
 		</div>

From fb90771da10a48680db1d66b0f44b3e9d0ac6088 Mon Sep 17 00:00:00 2001
From: Matthew Bernhardt <mjbernha@mit.edu>
Date: Fri, 2 Oct 2026 11:29:56 -0400
Subject: [PATCH 2/2] Re-run build

---
 .../build/hero-section/render.php                    | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/web/app/plugins/mitlib-post-hero-images/build/hero-section/render.php b/web/app/plugins/mitlib-post-hero-images/build/hero-section/render.php
index a7e38afc..eb55e690 100644
--- a/web/app/plugins/mitlib-post-hero-images/build/hero-section/render.php
+++ b/web/app/plugins/mitlib-post-hero-images/build/hero-section/render.php
@@ -55,6 +55,12 @@
 	$escaped_hero_credit = $escaped_citation;
 }
 
+$allowed_html = array(
+	'a' => array(
+		'href' => array(),
+	),
+);
+
 ?><section id="hero">
 	<div class="hero-bg" role="img" aria-label="<?php echo esc_attr( $hero_alt_text ); ?>" style="background-image: url(<?php echo esc_url( $hero_image_url ); ?>);"></div>
 	<div class="overlay">	
@@ -72,11 +78,7 @@
 			</div>
 			<?php if ( $escaped_hero_credit ) : ?>
 			<span class="hero-image-credit">
-				<?php
-				// phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped -- built from esc_html()/esc_url() pieces above.
-				echo $escaped_hero_credit;
-				// phpcs:enable -- resume normal scanning.
-				?>
+				<?php echo wp_kses( $escaped_hero_credit, $allowed_html ); ?>
 			</span>
 			<?php endif; ?>
 		</div>