Skip to content

REST API: Fix object/array validation for JSON strings in GET requests (#64926) #11371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
liaisontw wants to merge 1 commit into
base: trunk
Choose a base branch
from
+50 −0
Open

REST API: Fix object/array validation for JSON strings in GET requests (#64926) #11371

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions src/wp-includes/rest-api.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2182,6 +2182,7 @@ function rest_get_allowed_schema_keywords() {
* @return true|WP_Error
*/
function rest_validate_value_from_schema( $value, $args, $param = '' ) {

if ( isset( $args['anyOf'] ) ) {
$matching_schema = rest_find_any_matching_schema( $value, $args, $param );
if ( is_wp_error( $matching_schema ) ) {
Expand Down Expand Up @@ -2243,9 +2244,32 @@ function rest_validate_value_from_schema( $value, $args, $param = '' ) {
$is_valid = rest_validate_boolean_value_from_schema( $value, $param );
break;
case 'object':
/*
* A JSON-encoded string (e.g. from a GET query parameter) should be
* decoded before validation, mirroring what parse_json_params() does
* for application/json request bodies.
*/
if ( is_string( $value ) ) {
$decoded = json_decode( $value, true );
if ( null !== $decoded && JSON_ERROR_NONE === json_last_error() ) {
$value = $decoded;
}
}
$is_valid = rest_validate_object_value_from_schema( $value, $args, $param );
break;
case 'array':
/*
* A JSON-encoded string (e.g. ?ids=[1,2,3]) should be decoded before
* validation. This takes priority over the comma-separated-value
* fallback in rest_is_array() / wp_parse_list(), which cannot
* preserve value types.
*/
if ( is_string( $value ) && str_starts_with( ltrim( $value ), '[' ) ) {
$decoded = json_decode( $value, true );
if ( is_array( $decoded ) && JSON_ERROR_NONE === json_last_error() ) {
$value = $decoded;
}
}
$is_valid = rest_validate_array_value_from_schema( $value, $args, $param );
break;
case 'number':
Expand Down Expand Up @@ -2780,6 +2804,7 @@ function rest_validate_integer_value_from_schema( $value, $args, $param ) {
* @return mixed|WP_Error The sanitized value or a WP_Error instance if the value cannot be safely sanitized.
*/
function rest_sanitize_value_from_schema( $value, $args, $param = '' ) {

if ( isset( $args['anyOf'] ) ) {
$matching_schema = rest_find_any_matching_schema( $value, $args, $param );
if ( is_wp_error( $matching_schema ) ) {
Expand Down Expand Up @@ -2833,6 +2858,19 @@ function rest_sanitize_value_from_schema( $value, $args, $param = '' ) {
}

if ( 'array' === $args['type'] ) {
/*
* A JSON-encoded string (e.g. ?ids=[1,2,3]) should be decoded before
* sanitization. This takes priority over the comma-separated-value
* fallback in rest_sanitize_array() / wp_parse_list(), which cannot
* preserve value types.
*/
if ( is_string( $value ) && str_starts_with( ltrim( $value ), '[' ) ) {
$decoded = json_decode( $value, true );
if ( is_array( $decoded ) && JSON_ERROR_NONE === json_last_error() ) {
$value = $decoded;
}
}

$value = rest_sanitize_array( $value );

if ( ! empty( $args['items'] ) ) {
Expand All @@ -2850,6 +2888,18 @@ function rest_sanitize_value_from_schema( $value, $args, $param = '' ) {
}

if ( 'object' === $args['type'] ) {
/*
* A JSON-encoded string (e.g. from a GET query parameter) should be
* decoded before sanitization, mirroring what parse_json_params() does
* for application/json request bodies.
*/
if ( is_string( $value ) ) {
$decoded = json_decode( $value, true );
if ( null !== $decoded && JSON_ERROR_NONE === json_last_error() ) {
$value = $decoded;
}
}

$value = rest_sanitize_object( $value );

foreach ( $value as $property => $v ) {
Expand Down
Loading