Skip to content

REST API: Validate and sanitize every consumed route parameter #738

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
obenland wants to merge 4 commits into
base: trunk
Choose a base branch
from
Open

REST API: Validate and sanitize every consumed route parameter #738

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
70d1460
Coding Standards: Exempt test file names from the hyphenation rule.
obenland Jul 25, 2026
c65fbe5
Plugin Directory: Add argument schemas to REST API routes.
obenland Jul 25, 2026
af7c725
Theme Directory: Add argument schemas to REST API routes.
obenland Jul 25, 2026
b929d15
Also Viewing: Add argument schemas to the currentlyViewing REST route.
obenland Jul 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions phpcs.xml.dist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,11 @@
<exclude phpcbf-only="true" name="PEAR.Functions.FunctionCallSignature" />
</rule>

<!-- PHPUnit derives test class names from file names, and class names cannot contain hyphens. -->
<rule ref="WordPress.Files.FileName.NotHyphenatedLowercase">
<exclude-pattern>*/tests/*</exclude-pattern>
</rule>

<rule ref="WordPress-Docs">
<!-- Descriptive names make explicit comments unnecessary in many cases. -->
<exclude name="Squiz.Commenting.FunctionComment.MissingParamComment" />
Expand Down
16 changes: 16 additions & 0 deletions wordpress.org/public_html/wp-content/plugins/plugin-directory/api/class-base.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,22 @@ function validate_plugin_slug_callback( $value ) {
return is_string( $value ) && $value && Plugin_Directory::get_plugin_post( $value );
}

/**
* A sanitization callback for REST API locale parameters.
*
* Restricts the value to the characters present in WordPress locale slugs.
*
* @param string $value The requested locale.
* @return string The sanitized locale.
*/
public function sanitize_locale_callback( $value ) {
if ( ! is_scalar( $value ) ) {
return '';
}

return preg_replace( '/[^A-Za-z0-9_-]/', '', (string) $value );
}

/**
* A Permission Check callback which validates the request against the internal api-call token.
*
Expand Down
40 changes: 39 additions & 1 deletion ...ess.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-gandalf-scan.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,48 @@ public function __construct() {
[
'methods' => \WP_REST_Server::CREATABLE,
'callback' => [ $this, 'scan_callback' ],

/*
* Fields are typed but not required, and tolerate nulls, so
* that malformed callbacks reach the callback and are recorded
* on the plugin instead of being rejected at the REST layer.
*/
'args' => [
'plugin_slug' => [
'plugin_slug' => [
'validate_callback' => [ $this, 'validate_plugin_slug_callback' ],
],
'scan_id' => [
'type' => 'string',
],
'version' => [
'type' => 'string',
],
'release_ref' => [
'type' => 'string',
],
'status' => [
'type' => 'string',
],
'findings_count' => [
'type' => [ 'integer', 'null' ],
],
'severity_counts' => [
'type' => [ 'object', 'null' ],
],
'verdict_hash' => [
'type' => [ 'string', 'null' ],
],
'report_url' => [
'type' => [ 'string', 'null' ],
'format' => 'uri',
],
'error' => [
'type' => [ 'object', 'null' ],
'properties' => [
'kind' => [ 'type' => 'string' ],
'message' => [ 'type' => 'string' ],
],
],
],
'permission_callback' => function ( $request ) {
return $this->permission_check_api_bearer( $request, 'WP_GANDALF_SCAN_SHARED_SECRET' );
Expand Down
11 changes: 11 additions & 0 deletions ...s.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-internal-stats.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,13 @@ function __construct() {
'methods' => \WP_REST_Server::CREATABLE,
'callback' => array( $this, 'bulk_update_stats' ),
'permission_callback' => array( $this, 'permission_check_internal_api_bearer' ),
'args' => array(
// Entries are unconstrained so one malformed plugin cannot reject the batch.
'plugins' => array(
'type' => 'object',
'required' => true,
),
),
) );
}

Expand All @@ -46,6 +53,10 @@ function bulk_update_stats( $request ) {
$data = $request['plugins'];

foreach ( $data as $plugin_slug => $stats ) {
if ( ! is_array( $stats ) ) {
continue;
}

$plugin = Plugin_Directory::get_plugin_post( $plugin_slug );
if ( ! $plugin ) {
continue;
Expand Down
13 changes: 13 additions & 0 deletions ...org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-blueprint.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,19 @@ public function __construct() {
'plugin_slug' => array(
'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
),
'zip_hash' => array(
'type' => 'string',
),
'url_hash' => array(
'type' => 'string',
),
'type' => array(
'type' => 'string',
),
'lang' => array(
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
),
)
) );
}
Expand Down
19 changes: 10 additions & 9 deletions ...rg/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-committers.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,12 @@ class Plugin_Committers extends Base {

function __construct() {
register_rest_route( 'plugins/v1', '/plugin/(?P<plugin_slug>[^/]+)/committers/?', array(
'args' => array(
'plugin_slug' => array(
'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
'required' => true,
),
),
array(
'methods' => WP_REST_Server::READABLE,
'callback' => array( $this, 'list_committers' ),
Expand All @@ -28,12 +34,6 @@ function __construct() {
Plugin_Directory::get_plugin_post( $request['plugin_slug'] )
);
},
'args' => array(
'plugin_slug' => array(
'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
'required' => true,
),
),
),
array(
'methods' => WP_REST_Server::CREATABLE,
Expand All @@ -45,9 +45,10 @@ function __construct() {
);
},
'args' => array(
'plugin_slug' => array(
'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
'required' => true,
// The user_login, user_nicename, or user_email of the user to add.
'committer' => array(
'type' => 'string',
'required' => true,
),
),
),
Expand Down
11 changes: 10 additions & 1 deletion ...html/wp-content/plugins/plugin-directory/api/routes/class-plugin-release-confirmation.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
use WP_REST_Response;
use WordPressdotorg\Plugin_Directory\Plugin_Directory;
use WordPressdotorg\Plugin_Directory\API\Base;
use WordPressdotorg\Plugin_Directory\Template;
use WordPressdotorg\Plugin_Directory\Tools;
use WordPressdotorg\Plugin_Directory\Jobs\Plugin_Import;
use WordPressdotorg\Plugin_Directory\Email\Release_Confirmation_Enabled as Release_Confirmation_Enabled_Email;
Expand All @@ -28,6 +29,10 @@ public function __construct() {
'plugin_slug' => [
'validate_callback' => [ $this, 'validate_plugin_slug_callback' ],
],
'confirmations_required' => [
'type' => 'integer',
'minimum' => 0,
],
],
'permission_callback' => function( $request ) {
$plugin = Plugin_Directory::get_plugin_post( $request['plugin_slug'] );
Expand All @@ -45,7 +50,11 @@ public function __construct() {
],
'plugin_tag' => [
'validate_callback' => [ $this, 'validate_plugin_tag_callback' ],
]
],
'rollout_strategy' => [
'type' => 'string',
'enum' => array_keys( Template::get_rollout_strategies() ),
],
],
'permission_callback' => [ $this, 'permission_can_access_plugin' ],
] );
Expand Down
9 changes: 9 additions & 0 deletions ...ss.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-review.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,15 @@ function __construct() {
'methods' => WP_REST_Server::READABLE,
'callback' => array( $this, 'plugin_review_info' ),
'permission_callback' => array( $this, 'plugin_info_permission_check' ),
'args' => array(
'plugin_id' => array(
'type' => 'integer',
),
'token' => array(
'type' => 'string',
'pattern' => '^[a-f0-9]{32}$',
),
),
) );
}

Expand Down
4 changes: 4 additions & 0 deletions ..._html/wp-content/plugins/plugin-directory/api/routes/class-plugin-self-toggle-preview.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,10 @@ public function __construct() {
'plugin_slug' => [
'validate_callback' => [ $this, 'validate_plugin_slug_callback' ],
],
// Whether to dismiss the missing blueprint notice instead of toggling the preview.
'dismiss' => [
'type' => 'boolean',
],
],
'permission_callback' => function( $request ) {
$plugin = Plugin_Directory::get_plugin_post( $request['plugin_slug'] );
Expand Down
19 changes: 10 additions & 9 deletions .../public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-support-reps.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,12 @@ class Plugin_Support_Reps extends Base {

function __construct() {
register_rest_route( 'plugins/v1', '/plugin/(?P<plugin_slug>[^/]+)/support-reps/?', array(
'args' => array(
'plugin_slug' => array(
'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
'required' => true,
),
),
array(
'methods' => WP_REST_Server::READABLE,
'callback' => array( $this, 'list_support_reps' ),
Expand All @@ -28,12 +34,6 @@ function __construct() {
Plugin_Directory::get_plugin_post( $request['plugin_slug'] )
);
},
'args' => array(
'plugin_slug' => array(
'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
'required' => true,
),
),
),
array(
'methods' => WP_REST_Server::CREATABLE,
Expand All @@ -45,9 +45,10 @@ function __construct() {
);
},
'args' => array(
'plugin_slug' => array(
'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
'required' => true,
// The user_login, user_nicename, or user_email of the user to add.
'support_rep' => array(
'type' => 'string',
'required' => true,
),
),
),
Expand Down
6 changes: 6 additions & 0 deletions ...ss.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-upload.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ function __construct() {
'callback' => array( $this, 'upload' ),
'permission_callback' => array( $this, 'permission_check' ),
'args' => [
'ID' => [
'type' => 'integer',
],
'post_name' => [
'type' => 'string',
'required' => false,
Expand All @@ -38,6 +41,9 @@ function __construct() {
'callback' => array( $this, 'slug' ),
'permission_callback' => array( $this, 'permission_check' ),
'args' => [
'ID' => [
'type' => 'integer',
],
'post_name' => [
'type' => 'string',
'required' => true,
Expand Down
6 changes: 5 additions & 1 deletion wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ function __construct() {
'plugin_slug' => array(
'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
),
'locale' => array(
'type' => 'string',
'sanitize_callback' => array( $this, 'sanitize_locale_callback' ),
),
),
) );
}
Expand Down Expand Up @@ -373,7 +377,7 @@ protected function get_user_profile_link( $user ) {
*/
protected function get_plugin_reviews_markup( $plugin_slug ) {
$output = '';
foreach ( Tools::get_plugin_reviews( $plugin_slug, 10 ) as $review ) {
foreach ( Tools::get_plugin_reviews( $plugin_slug, 10 ) ?: array() as $review ) {
$output .= $this->get_plugin_reviews_markup_singular( $review );
}
return $output;
Expand Down
54 changes: 54 additions & 0 deletions ...ss.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-query-plugins.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,60 @@ function __construct() {
'methods' => WP_REST_Server::READABLE,
'callback' => array( $this, 'query' ),
'permission_callback' => '__return_true',

/*
* api.wordpress.org proxies client input into this route verbatim,
* so all parameters coerce rather than reject: custom sanitize
* callbacks intentionally replace strict schema validation.
*/
'args' => array(
'paged' => array(
'type' => 'integer',
'sanitize_callback' => 'absint',
),
'posts_per_page' => array(
'type' => 'integer',
'sanitize_callback' => 'absint',
),
'browse' => array(
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
),
'favorites_user' => array(
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
),
'plugin_category' => array(
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
),
's' => array(
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
),
'author_name' => array(
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
),
'installed_plugins' => array(
'type' => array( 'string', 'array' ),
'items' => array( 'type' => 'string' ),
'sanitize_callback' => 'wp_parse_list',
),
'plugin_tags' => array(
'type' => array( 'string', 'array' ),
'items' => array( 'type' => 'string' ),
'sanitize_callback' => 'wp_parse_list',
),
'locale' => array(
'type' => 'string',
'sanitize_callback' => array( $this, 'sanitize_locale_callback' ),
),
'block' => array(
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
),
),
) );
}

Expand Down
Loading
Loading