Changeset 10529

Timestamp:

12/17/2020 01:33:02 AM (4 years ago)

Author:

dd32

Message:

Bad Requests: Block scanners injecting invalid inputs into the o2 queryVars fields.

File:

• sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php

@@ -38 +38 @@
  */
 add_action( 'send_headers', function( $wp ) {
+    check_for_invalid_query_vars( $wp->query_vars, '$public_query_vars' );
+} );
+
+/**
+ * Check a set of internal query variables against the WordPress WP_Query values to detect invalid input.
+ */
+function check_for_invalid_query_vars( $vars, $ref = '$public_query_vars' ) {
     // Assumption: WP::$public_query_vars will only ever contain non-array query vars.
     // Assumption invalid. Some fields are valid.
@@ -61 +68 @@
 
     foreach ( (new \WP)->public_query_vars as $field ) {
-        if ( isset( $wp->query_vars[ $field ] ) ) {
-            if ( ! is_scalar( $wp->query_vars[ $field ] ) && ! isset( $array_fields[ $field ] ) ) {
-                die_bad_request( "non-scalar $field in \$public_query_vars" );
+        if ( isset( $vars[ $field ] ) ) {
+            if ( ! is_scalar( $vars[ $field ] ) && ! isset( $array_fields[ $field ] ) ) {
+                die_bad_request( "non-scalar $field in $ref" );
             }
 
-            if ( isset( $must_be_num[ $field ] ) && ! empty( $wp->query_vars[ $field ] ) && ! is_numeric( $wp->query_vars[ $field ] ) ) {
-                die_bad_request( "non-numeric $field in \$public_query_vars" );
+            if ( isset( $must_be_num[ $field ] ) && ! empty( $vars[ $field ] ) && ! is_numeric( $vars[ $field ] ) ) {
+                die_bad_request( "non-numeric $field in $ref" );
             }
         }
     }
-
-} );
+}
 
 /**
@@ -82 +88 @@
             die_bad_request( "non-scalar input to o2" );
         }
+    }
+    if ( isset( $_REQUEST['queryVars'] ) ) {
+        check_for_invalid_query_vars( $_REQUEST['queryVars'], 'o2 queryVars' );
     }
 }, 9 );