Changeset 11349

Timestamp:

12/01/2021 03:30:43 AM (3 years ago)

Author:

dd32

Message:

Events API: Validate the request is valid before processing it.

A number of vulnerability scanners are sending junk requestes to the API endpoint that causes PHP Notices & Warnings.

File:

• sites/trunk/api.wordpress.org/public_html/events/1.0/index.php (modified) (3 diffs)

sites/trunk/api.wordpress.org/public_html/events/1.0/index.php

@@ -8 +8 @@
 function main() {
     global $cache_group, $cache_life;
+
+    validate_request();
 
     bootstrap();
@@ -125 +127 @@
 
     // If a precise location is known, use a GET request. The values here should come from the `location` key of the result of a POST request.
-    if ( isset( $_GET['latitude'] ) ) {
+    if ( isset( $_GET['latitude'], $_GET['longitude'] ) ) {
         $location_args['latitude']  = $_GET['latitude'];
         $location_args['longitude'] = $_GET['longitude'];
@@ -169 +171 @@
 
     return $location_args;
+}
+
+/**
+ * Validate that the incoming request is in a valid format.
+ */
+function validate_request() {
+    // Not all clients have a user agent.
+    if ( ! isset( $_SERVER['HTTP_USER_AGENT'] ) ) {
+        $_SERVER['HTTP_USER_AGENT'] = '';
+    }
+
+    $must_be_strings = [
+        'latitude',
+        'longitude',
+        'country',
+        'location',
+        'timezone',
+        'locale',
+        'ip',
+    ];
+
+    foreach ( $must_be_strings as $field ) {
+        if ( isset( $_GET[ $field ] ) && ! is_scalar( $_GET[ $field ] ) ) {
+            header( $_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request', true, 400 );
+            die( '{"error":"Bad request.","reason":"' . $field . ' must be of type string."}' );
+        }
+    }
+
+    if ( ! empty( $_POST['location_data'] ) ) {
+        foreach ( $_POST['location_data'] as $field => $value ) {
+            if ( ! is_scalar( $value ) ) {
+                header( $_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request', true, 400 );
+                die( '{"error":"Bad request.","reason":"' . $field . ' must be of type string."}' );
+            }
+        }
+    }
 }