Upgrade to 3.5.8

kirby/config/blocks/image/image.php

@@ -9,7 +9,7 @@ $ratio   = $block->ratio()->or('auto');
 $src     = null;
 
 if ($block->location() == 'web') {
-    $src = $block->src();
+    $src = $block->src()->esc();
 } elseif ($image = $block->image()->toFile()) {
     $alt = $alt ?? $image->alt();
     $src = $image->url();
@@ -19,11 +19,11 @@ if ($block->location() == 'web') {
 <?php if ($src): ?>
 <figure<?= attr(['data-ratio' => $ratio, 'data-crop' => $crop], ' ') ?>>
   <?php if ($link->isNotEmpty()): ?>
-  <a href="<?= $link->toUrl() ?>">
-    <img src="<?= $src ?>" alt="<?= $alt ?>">
+  <a href="<?= esc($link->toUrl()) ?>">
+    <img src="<?= $src ?>" alt="<?= $alt->esc() ?>">
   </a>
   <?php else: ?>
-  <img src="<?= $src ?>" alt="<?= $alt ?>">
+  <img src="<?= $src ?>" alt="<?= $alt->esc() ?>">
   <?php endif ?>
 
   <?php if ($caption->isNotEmpty()): ?>

kirby/config/fields/writer.php

@@ -1,5 +1,7 @@
 <?php
 
+use Kirby\Sane\Html;
+
 return [
     'props' => [
         /**
@@ -27,7 +29,7 @@ return [
     ],
     'computed' => [
         'value' => function () {
-            return trim($this->value);
+            return Html::sanitize(trim($this->value));
         }
     ],
 ];