Add dimension validation to sideload endpoint by adamsilverstein · Pull Request #74903 · WordPress/gutenberg

adamsilverstein · 2026-01-23T17:19:06Z

Summary

Adds validation to ensure uploaded image dimensions match expected dimensions for the specified image size in the wp/v2/media/<id>/sideload endpoint.

Fixes #74360

Problem

Previously, the sideload endpoint accepted any image regardless of its dimensions. A user could upload a 1000x1000 image claiming it's a "thumbnail" (150x150), and the code would accept it without validation.

Solution

Added a validate_image_dimensions() method that checks uploaded dimensions against expected size constraints:

'original' size: Must match original attachment dimensions exactly
'full' size (PDF thumbnails): Requires positive dimensions only
Regular sizes: Dimensions must not exceed registered size maximums (with 1px tolerance for rounding differences)

The validation runs after the file is uploaded but before metadata is updated. If validation fails, the uploaded file is cleaned up and a WP_Error is returned.

Test plan

Run existing tests to ensure no regressions
Verify oversized images are rejected with 400 error
Verify correctly-sized images are accepted with 200 response

npm run test:unit:php -- --filter=Gutenberg_REST_Attachments_Controller_Test

🤖 Generated with Claude Code

github-actions · 2026-01-23T17:19:20Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: adamsilverstein <[email protected]>
Co-authored-by: swissspidy <[email protected]>
Co-authored-by: ramonjd <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-01-23T23:03:01Z

Flaky tests detected in 8b8aa9a.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/24863531627
📝 Reported issues:

[Flaky Test] post title and content are editable and blocks can be inserted #76524 in /test/e2e/specs/editor/various/post-content-focus-mode.spec.js

Validates uploaded image dimensions against expected size constraints in the wp/v2/media/<id>/sideload endpoint. This prevents users from uploading incorrectly-sized images for a specified image size. Validation rules: - 'original' size: must match original attachment dimensions exactly - 'full' and 'scaled' sizes: requires positive dimensions only - Regular sizes: dimensions must not exceed registered size maximums (with 1px tolerance for rounding differences) Also updates existing tests to use appropriately-sized images and adds two new test cases for dimension validation. Co-Authored-By: Claude Opus 4.6 <[email protected]>

swissspidy

Makes sense!

Links Gutenberg PR #74903 (dimension validation for sideload endpoint) to its corresponding WordPress Core PR. Co-Authored-By: Claude Opus 4.6 <[email protected]>

Remove the file_exists check from filter_wp_unique_filename so sideloaded sub-sizes can replace existing files. The attachment name check is sufficient to prevent unintended overwrites. Also consolidate the positive-dimension check and fix translators comment argument order.

adamsilverstein · 2026-03-17T21:48:06Z

@andrewserong another one to review when you have a chance, no hurry though!

ramonjd

LGTM. Just left some non blocking questions. This is still an experiment, right?

I uploaded a large image and told the sideload endpoint it was a thumbnail:

curl -u "admin:Ysn5 AMiG 6N2k cEAK guz8 KqoZ" \
  -X POST "http://localhost:8888/wp-json/wp/v2/media/243/sideload?image_size=thumbnail" \
  -H "Content-Disposition: attachment; filename=196-150x150.jpg" \
  -H "Content-Type: image/jpeg" \
  --data-binary @./196.jpg

->>>

{"code":"rest_upload_dimension_mismatch","message":"Uploaded image width (3008) exceeds maximum for \"thumbnail\" size (150).","data":{"status":400}}%

On trunk the response was 200.

Also tested happy path:

curl -u "admin:Ysn5 AMiG 6N2k cEAK guz8 KqoZ" \
  -X POST "http://localhost:8888/wp-json/wp/v2/media/244/sideload?image_size=thumbnail" \
  -H "Content-Disposition: attachment; filename=test-image-1-100x100.jpg-150x150.jpg" \
  -H "Content-Type: image/jpeg" \
  --data-binary @./test-image-1-100x100.jpg

Address review feedback: return a WP_Error when wp_getimagesize() returns false (corrupted file, unsupported format) instead of silently proceeding with zero dimensions. This also simplifies the downstream code since $size is now guaranteed to be a valid array.

adamsilverstein · 2026-03-30T20:47:28Z

I uploaded a large image and told the sideload endpoint it was a thumbnail

"thumbnail" here might just mean "sub size", let me test with a large image to see if I get the expected -scaled image.

Layer dimension validation on top of trunk's sub_size_data return pattern: read dimensions once up front, run validate_image_dimensions (now accepting string|array image_size), then build the flat sub-size payload the finalize endpoint expects. Keep PR and trunk test coverage side by side.

Two tests had stale assertions after the switch to 'thumbnail' size (still expecting 'medium'), and two newer trunk tests used canola.jpg (640x480) in their sideload body, which now fails dimension validation against medium (300x300) and thumbnail (150x150). Use test-image.jpg (50x50) to fit within constraints.

adamsilverstein · 2026-05-06T18:06:22Z

testing with a large image, I do see a scaled image created. I noticed a separate bug though, where the subsizes all get the "-scaled" naming suffix that is supposed to apply only to the scaled image itself. I am opening a separate issue for this.

current:

correct (server):

adamsilverstein · 2026-05-06T18:17:57Z

testing with a large image, I do see a scaled image created. I noticed a separate bug though, where the subsizes all get the "-scaled" naming suffix that is supposed to apply only to the scaled image itself. I am opening a separate issue for this.

opened #78037 which i want to land fist before testing and merging this.

…ision Reflect four client-side media PRs merged after these docs were last revised, keeping the architecture and how-to guides in sync with current behavior: - #76707: document the disabled libvips operation cache (Cache.max(0)) and the 50-operation worker recycling that bound WASM linear-memory growth, plus the globalThis.__vipsDebug hook for capturing the suppressed vips output. - #74903: document the sideload endpoint's image-dimension validation and its 400 error responses (rest_upload_dimension_mismatch and friends). - #78359: note that the finalize endpoint returns the refreshed attachment, which the editor uses to keep the block URL (and front-end srcset) in sync. - #78038: clarify that sub-size filenames derive from the original basename and only the scaled full-size copy carries the -scaled suffix.

adamsilverstein requested a review from spacedmonkey as a code owner January 23, 2026 17:19

adamsilverstein added [Type] Enhancement A suggestion for improvement. [Feature] Client Side Media Media processing in the browser with WASM labels Jan 23, 2026

adamsilverstein added this to WordPress 7.0 Editor Tasks Jan 23, 2026

github-project-automation Bot moved this to 🔎 Needs Review in WordPress 7.0 Editor Tasks Jan 23, 2026

adamsilverstein requested review from andrewserong, ramonjd and swissspidy and removed request for spacedmonkey January 23, 2026 17:22

adamsilverstein linked an issue Jan 23, 2026 that may be closed by this pull request

Ensure REST API endpoint for side-loaded media covers all requirements #74360

Closed

4 tasks

adamsilverstein force-pushed the feature/client-side-media-dev branch from 1fb78d7 to 89e2a02 Compare February 2, 2026 20:04

adamsilverstein requested review from ajitbohra, ellatrix, nerrad and ntwb as code owners February 2, 2026 20:04

adamsilverstein marked this pull request as draft March 1, 2026 06:17

adamsilverstein changed the base branch from feature/client-side-media-dev to trunk March 1, 2026 07:17

adamsilverstein force-pushed the 74360-ensure-rest-api-complete branch from a537683 to beff757 Compare March 1, 2026 09:22

swissspidy approved these changes Mar 1, 2026

View reviewed changes

adamsilverstein mentioned this pull request Mar 1, 2026

REST API: Add dimension validation to sideload endpoint WordPress/wordpress-develop#11100

Open

2 tasks

adamsilverstein and others added 2 commits March 1, 2026 17:48

Add backport-changelog entry for Core PR #11100

28de645

Links Gutenberg PR #74903 (dimension validation for sideload endpoint) to its corresponding WordPress Core PR. Co-Authored-By: Claude Opus 4.6 <[email protected]>

adamsilverstein marked this pull request as ready for review March 17, 2026 21:46

adamsilverstein removed request for ajitbohra, ellatrix, nerrad and ntwb March 17, 2026 21:47

adamsilverstein added the [Status] In Progress Tracking issues with work in progress label Mar 17, 2026

adamsilverstein self-assigned this Mar 17, 2026

ramonjd reviewed Mar 18, 2026

View reviewed changes

Comment thread lib/media/class-gutenberg-rest-attachments-controller.php

ramonjd approved these changes Mar 18, 2026

View reviewed changes

Comment thread lib/media/class-gutenberg-rest-attachments-controller.php

Comment thread lib/media/class-gutenberg-rest-attachments-controller.php

Comment thread lib/media/class-gutenberg-rest-attachments-controller.php

adamsilverstein mentioned this pull request Mar 23, 2026

Client Side Media iteration for WordPress 7.1 #76756

Open

adamsilverstein added 2 commits April 23, 2026 15:31

adamsilverstein added this to WordPress 7.1 Editor Tasks May 6, 2026

adamsilverstein removed this from WordPress 7.0 Editor Tasks May 6, 2026

github-project-automation Bot moved this to 🔎 Needs Review in WordPress 7.1 Editor Tasks May 6, 2026

adamsilverstein removed this from WordPress 7.1 Editor Tasks May 6, 2026

adamsilverstein merged commit 9b4850e into trunk May 15, 2026
40 checks passed

adamsilverstein deleted the 74360-ensure-rest-api-complete branch May 15, 2026 16:11

github-actions Bot mentioned this pull request May 15, 2026

PHP backports for WP 7.0 #74043

Closed

github-actions Bot added this to the Gutenberg 23.3 milestone May 15, 2026

adamsilverstein mentioned this pull request May 22, 2026

Media: Re-introduce client-side media processing feature WordPress/wordpress-develop#11324

Closed

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add dimension validation to sideload endpoint#74903

Add dimension validation to sideload endpoint#74903
adamsilverstein merged 6 commits into
trunkfrom
74360-ensure-rest-api-complete

adamsilverstein commented Jan 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jan 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jan 23, 2026 •

edited

Loading

Uh oh!

swissspidy left a comment

Uh oh!

adamsilverstein commented Mar 17, 2026

Uh oh!

Uh oh!

ramonjd left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adamsilverstein commented Mar 30, 2026

Uh oh!

adamsilverstein commented May 6, 2026 •

edited

Loading

Uh oh!

adamsilverstein commented May 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

adamsilverstein commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Solution

Test plan

Uh oh!

github-actions Bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

swissspidy left a comment

Choose a reason for hiding this comment

Uh oh!

adamsilverstein commented Mar 17, 2026

Uh oh!

Uh oh!

ramonjd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adamsilverstein commented Mar 30, 2026

Uh oh!

adamsilverstein commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adamsilverstein commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

adamsilverstein commented Jan 23, 2026 •

edited

Loading

github-actions Bot commented Jan 23, 2026 •

edited

Loading

github-actions Bot commented Jan 23, 2026 •

edited

Loading

adamsilverstein commented May 6, 2026 •

edited

Loading

adamsilverstein commented May 6, 2026 •

edited

Loading