Changeset 10998

Timestamp:

05/27/2021 12:42:54 AM (5 years ago)

Author:

dd32

Message:

Translations API: Harden the API against invalid input.

This prevents PHP Warnings and hopefully will flag to users of the API when they call it incorrectly.

Location:

sites/trunk/api.wordpress.org/public_html/translations

Files:

• core/1.0/index.php (modified) (1 diff)
• lib.php (modified) (1 diff)
• plugins/1.0/index.php (modified) (1 diff)
• themes/1.0/index.php (modified) (1 diff)

sites/trunk/api.wordpress.org/public_html/translations/core/1.0/index.php

@@ -8 +8 @@
 wp_cache_init();
 
-$version = isset( $_REQUEST['version'] ) ? str_replace( '-src', '', $_REQUEST['version'] ) : WP_CORE_LATEST_RELEASE;
+$version = WP_CORE_LATEST_RELEASE;
+if ( isset( $_REQUEST['version'] ) ) {
+        $version = $_REQUEST['version'];
+        if ( ! is_string( $version ) || ! is_numeric( $version[0] ) ) {
+                header( $_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request' );
+                die( '?version= must be a valid WordPress version' );
+        }
+
+        $version = str_replace( '-src', '', $version );
+}
 
 $translations = find_all_translations_for_core( $version );

sites/trunk/api.wordpress.org/public_html/translations/lib.php

@@ -18 +18 @@
         if ( $type === 'core' && null === $version ) {
                 $version = WP_CORE_LATEST_RELEASE;
+        }
+
+        // Optimize against junk inputs.
+        if ( ! $domain || ! is_string( $domain ) ) {
+                return array();
+        }
+        if ( $version && ! is_string( $version ) ) {
+                return array();
         }
 

sites/trunk/api.wordpress.org/public_html/translations/plugins/1.0/index.php

@@ -8 +8 @@
 wp_cache_init();
 
-$slug = isset( $_REQUEST['slug'] ) ? $_REQUEST['slug'] : '';
+$slug    = isset( $_REQUEST['slug'] )    ? $_REQUEST['slug']    : '';
 $version = isset( $_REQUEST['version'] ) ? $_REQUEST['version'] : null;
+
+foreach ( [ 'slug', 'version' ] as $field ) {
+        if ( $$field && ! is_string( $$field ) ) {
+                header( $_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request' );
+                die( "?{$field}= invalid." );
+        }
+}
 
 $translations = find_all_translations_for_type_and_domain( 'plugin', $slug, $version );

sites/trunk/api.wordpress.org/public_html/translations/themes/1.0/index.php

@@ -8 +8 @@
 wp_cache_init();
 
-$slug = isset( $_REQUEST['slug'] ) ? $_REQUEST['slug'] : '';
+$slug    = isset( $_REQUEST['slug'] )    ? $_REQUEST['slug']    : '';
 $version = isset( $_REQUEST['version'] ) ? $_REQUEST['version'] : null;
+
+foreach ( [ 'slug', 'version' ] as $field ) {
+        if ( $$field && ! is_string( $$field ) ) {
+                header( $_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request' );
+                die( "?{$field}= invalid." );
+        }
+}
 
 $translations = find_all_translations_for_type_and_domain( 'theme', $slug, $version );