Changeset 10471

Timestamp:

11/26/2020 11:52:07 PM (4 years ago)

Author:

dd32

Message:

Bad Requests: Block requets from vuln scanners hitting Jetpack share by email forms.

File:

• sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php

@@ -109 +109 @@
 
 /**
+ * Detect invalid requests from vulnerability scanners to Jetpack Share by Email forms.
+ */
+add_action( 'send_headers', function() {
+    if ( ! isset( $_REQUEST['share'] ) ) {
+        return;
+    }
+
+    $share_by_email_fields = [
+        'target_email',
+        'source_email',
+        'source_f_name',
+        'source_name',
+    ];
+
+    foreach ( $share_by_email_fields as $field ) {
+        if ( isset( $_POST[ $field ] ) && ! is_scalar( $_REQUEST[ $field ] ) ) {
+            die_bad_request( "non-scalar $field in Jetpack Share By Email" );
+        }
+    }
+} );
+
+/**
  * Die with a 400 Bad Request.
  *