Themes API: Validate actions and protocol input, document trusted output paths - #801
Open
obenland wants to merge 8 commits into
Open
Themes API: Validate actions and protocol input, document trusted output paths#801obenland wants to merge 8 commits into
obenland wants to merge 8 commits into
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
There was a problem hiding this comment.
Pull request overview
This PR hardens the unauthenticated Themes API endpoints by validating user-controlled inputs (actions, protocol strings, JSONP callback) and adding narrowly scoped PHPCS ignores where escaping/sanitizing would corrupt serialized/JSON payloads or where WordPress isn’t loaded yet.
Changes:
- Adds stricter validation for
SERVER_PROTOCOLandactionparameters in the Themes Info endpoints (1.0/1.2). - Documents and justifies output-not-escaped paths for JSON/serialized responses and pre-WordPress request parsing.
- Sanitizes CORS origin and JSONP callback handling paths, adding targeted PHPCS ignores.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| api.wordpress.org/public_html/themes/theme-directory/1.0/index.php | Sanitizes Origin/JSONP callback output and refactors action/nonce/theme input handling for authenticated theme-favorite actions. |
| api.wordpress.org/public_html/themes/info/1.2/index.php | Adds file-level PHPCS rationale and validates protocol/action when normalizing “flat” GET requests before delegating to 1.1. |
| api.wordpress.org/public_html/themes/info/1.1/index.php | Adds file-level PHPCS rationale, refines JSONP callback sanitization, and documents trusted output of 1.0 payload. |
| api.wordpress.org/public_html/themes/info/1.0/index.php | Documents pre-WordPress request parsing, validates SERVER_PROTOCOL and action, and adds justified output/unsanitized-input ignores for serialized/JSON payloads. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
obenland
force-pushed
the
api/security-themes
branch
3 times, most recently
from
August 13, 2026 01:23
0a0aba4 to
04e75ba
Compare
…put paths. API actions are validated against their expected format, the server protocol is validated before being echoed into status headers, and JSONP callbacks are sanitized at the source. The serialized/JSON response paths carry narrow, justified ignores since escaping would corrupt the payloads, and request parsing before WordPress loads is documented via justified file-level unslash/nonce disables. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit 5c8b73f740980cc1047bcbba93c09ec636feff3a)
obenland
force-pushed
the
api/security-themes
branch
from
August 13, 2026 01:28
04e75ba to
fe7ccd6
Compare
JSONP callbacks that are not valid JavaScript identifiers (e.g. starting with a digit) now fall back to plain JSON instead of emitting invalid script. The theme-directory action and theme parameters are validated against their expected formats and rejected when malformed, rather than sanitize_key() silently transforming a malformed value into a valid one — which had made `add-favorite@@` executable where trunk rejected it. The 1.2 endpoint now rejects every non-GET/HEAD method, not just POST. Inline ignores are restored to single-line form, since an annotation inside a multi-line block comment does not apply to the code following the comment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ocks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replaces the strip-then-check-first-character dance with one identifier validation; a callback that isn't a valid JavaScript identifier falls back to plain JSON instead of being partially salvaged into a different (wrong) function name. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…s justification. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ites. An invalid or array `theme` parameter was coerced to an empty string or false by the validation fallback and still written to the user's favorites meta with a success response; it now returns bad_request. The slug pattern also allows underscores, which sanitize_title_with_dashes() preserves and the themes info endpoint already accepts. The 1.2 method guard no longer rejects OPTIONS — trunk served preflights — and the Allow header lists the permitted methods. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PCRE's $ end-anchor matches before a trailing newline, letting values like "twentytwenty\n" pass slug and protocol validation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of a sweep resolving all
WordPress.SecurityPHPCS findings on the unauthenticated api.wordpress.org endpoints.[a-z_]format across 1.0 and 1.2.SERVER_PROTOCOLis format-validated before being echoed into status headers.All files report zero
WordPress.Securityviolations.🤖 Generated with Claude Code