Changeset 14729

Timestamp:

03/19/2026 01:45:06 PM (10 days ago)

Author:

obenland

Message:

WP.org Abilities: Improve input validation and add return type declarations.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-abilities/plugins/plugin-directory

Files:

• prompts/class-address-review-feedback.php (modified) (1 diff)
• prompts/class-prepare-plugin.php (modified) (1 diff)
• prompts/class-run-plugin-check.php (modified) (1 diff)
• tools/class-get-plugin-status.php (modified) (1 diff)
• tools/class-submit-plugin.php (modified) (7 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-abilities/plugins/plugin-directory/prompts/class-address-review-feedback.php

@@ -55 +55 @@
     public static function execute( array $input ): array {
         // Defensive fallback — input_schema marks plugin_slug as required but the framework may not enforce it.
-        $plugin_slug = $input['plugin_slug'] ?? '{plugin_slug}';
+        $plugin_slug = sanitize_title( $input['plugin_slug'] ?? '{plugin_slug}' );
 
         $text = <<<MD

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-abilities/plugins/plugin-directory/prompts/class-prepare-plugin.php

@@ -55 +55 @@
     public static function execute( array $input ): array {
         // Defensive fallback — input_schema marks plugin_path as required but the framework may not enforce it.
-        $plugin_path = $input['plugin_path'] ?? '{plugin_path}';
+        $plugin_path = sanitize_text_field( $input['plugin_path'] ?? '{plugin_path}' );
 
         $text = <<<MD

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-abilities/plugins/plugin-directory/prompts/class-run-plugin-check.php

@@ -55 +55 @@
     public static function execute( array $input ): array {
         // Defensive fallback — input_schema marks plugin_path as required but the framework may not enforce it.
-        $plugin_path = $input['plugin_path'] ?? '{plugin_path}';
+        $plugin_path = sanitize_text_field( $input['plugin_path'] ?? '{plugin_path}' );
 
         $text = <<<MD

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-abilities/plugins/plugin-directory/tools/class-get-plugin-status.php

@@ -123 +123 @@
      * @return true|\WP_Error
      */
-    public static function check_permission() {
+    public static function check_permission(): bool|\WP_Error {
         if ( get_current_user_id() > 0 ) {
             return true;

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-abilities/plugins/plugin-directory/tools/class-submit-plugin.php

@@ -166 +166 @@
      * @return true|\WP_Error
      */
-    public static function check_permission() {
+    public static function check_permission(): bool|\WP_Error {
         if ( get_current_user_id() > 0 ) {
             return true;
@@ -243 +243 @@
         );
 
-        $_POST['comment'] = $input['comment'] ?? '';
+        $_POST['comment'] = sanitize_text_field( $input['comment'] ?? '' );
 
         if ( ! empty( $input['upload_token'] ) ) {
-            $_REQUEST['upload_token'] = $input['upload_token'];
+            $_REQUEST['upload_token'] = sanitize_text_field( $input['upload_token'] );
         }
 
@@ -358 +358 @@
      * @return string|array Temp file path on success, or error response array on failure.
      */
-    private static function prepare_zip_file( array $input ) {
+    private static function prepare_zip_file( array $input ): array|string {
         require_once ABSPATH . 'wp-admin/includes/file.php';
 
@@ -382 +382 @@
      * @return string|array Temp file path on success, or error response array on failure.
      */
-    private static function prepare_zip_from_url( string $url ) {
+    private static function prepare_zip_from_url( string $url ): array|string {
         $url = esc_url_raw( $url );
 
@@ -401 +401 @@
         }
 
-        $temp_path = download_url( $url, 300 );
+        // Do not allow link-local addresses.
+        $host = wp_parse_url( $url, PHP_URL_HOST );
+        if ( $host ) {
+            $ip    = gethostbyname( $host );
+            $parts = array_map( 'intval', explode( '.', $ip ) );
+            if ( 169 === $parts[0] && 254 === $parts[1] ) {
+                return self::error_response(
+                    'invalid_url',
+                    'The URL is not allowed.',
+                    'Provide a publicly accessible HTTPS URL that does not point to an internal network address.'
+                );
+            }
+        }
+
+        $temp_path = download_url( $url );
         if ( is_wp_error( $temp_path ) ) {
             return self::error_response(
@@ -419 +433 @@
      * @return string|array Temp file path on success, or error response array on failure.
      */
-    private static function prepare_zip_from_base64( string $base64 ) {
+    private static function prepare_zip_from_base64( string $base64 ): array|string {
+        if ( strlen( $base64 ) > 64 * MB_IN_BYTES ) {
+            return self::error_response(
+                'zip_too_large',
+                'The zip_base64 payload exceeds the 64 MB limit.',
+                'Use zip_url instead for larger plugins.'
+            );
+        }
+
         $zip_data = base64_decode( $base64, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Decoding a ZIP file, not obfuscated code.
         if ( false === $zip_data ) {
@@ -461 +483 @@
      */
     private static function find_plugin_post( string $slug ): ?\WP_Post {
-        $posts = get_posts(
-            array(
-                'post_type'   => 'plugin',
-                'name'        => $slug,
-                'post_status' => 'any',
-                'numberposts' => 1,
-            )
-        );
-
-        $post = $posts[0] ?? null;
-
-        if ( ! $post ) {
-            return null;
-        }
-
-        // Allow the plugin author or users with plugin_approve capability.
-        if ( get_current_user_id() === (int) $post->post_author || current_user_can( 'plugin_approve' ) ) { // phpcs:ignore WordPress.WP.Capabilities.Unknown -- plugin_approve is registered by the plugin-directory plugin.
-            return $post;
-        }
-
-        return null;
+        $query_args = array(
+            'post_type'   => 'plugin',
+            'name'        => $slug,
+            'post_status' => 'any',
+            'numberposts' => 1,
+        );
+
+        // Scope to the current user unless they can review plugins.
+        if ( ! current_user_can( 'plugin_approve' ) ) { // phpcs:ignore WordPress.WP.Capabilities.Unknown -- plugin_approve is registered by the plugin-directory plugin.
+            $query_args['author'] = get_current_user_id();
+        }
+
+        $posts = get_posts( $query_args );
+
+        return $posts[0] ?? null;
     }