Ticket #28523: 28523.2.diff

src/wp-includes/functions.php

@@ -3091 +3091 @@
 }
 
 /**
+ * Check that a JSONP callback is a valid JavaScript callback.
+ *
+ * This only allows alphanumeric characters and the dot character. This helps to
+ * mitigate XSS attacks caused by directly outputting user input.
+ *
+ * @since 4.5.0
+ * @param string $callback Supplied JSONP callback function.
+ * @return bool True if valid callback, false otherwise.
+ */
+function wp_check_jsonp_callback( $callback ) {
+        if ( ! is_string( $callback ) ) {
+                return false;
+        }
+
+        $jsonp_callback = preg_replace( '/[^\w\.]/', '', $callback, -1, $illegal_char_count );
+        return 0 === $illegal_char_count;
+}
+
+/**
  * Retrieve the WordPress home page URL.
  *
  * If the constant named 'WP_HOME' exists, then it will be used and returned

src/wp-includes/rest-api/class-wp-rest-server.php

@@ -280 +280 @@
                                 return false;
                         }
 
-                        // Check for invalid characters (only alphanumeric allowed).
-                        if ( is_string( $_GET['_jsonp'] ) ) {
-                                $jsonp_callback = preg_replace( '/[^\w\.]/', '', wp_unslash( $_GET['_jsonp'] ), -1, $illegal_char_count );
-                                if ( 0 !== $illegal_char_count ) {
-                                        $jsonp_callback = null;
-                                }
-                        }
-                        if ( null === $jsonp_callback ) {
+                        $jsonp_callback = $_GET['_jsonp'];
+                        if ( ! wp_check_jsonp_callback( $jsonp_callback ) ) {
                                 echo $this->json_error( 'rest_callback_invalid', __( 'The JSONP callback function is invalid.' ), 400 );
                                 return false;
                         }

tests/phpunit/tests/rest-api.php

@@ -322 +322 @@
 
         }
 
+        public function jsonp_callback_provider() {
+                return array(
+                        // Standard names
+                        array( 'Springfield', true ),
+                        array( 'shelby.ville', true ),
+                        array( 'cypress_creek', true ),
+                        array( 'KampKrusty1', true ),
+
+                        // Invalid names
+                        array( 'ogden-ville', false ),
+                        array( 'north haverbrook', false ),
+                        array( "Terror['Lake']", false ),
+                        array( 'Cape[Feare]', false ),
+                        array( '"NewHorrorfield"', false ),
+                        array( 'Scream\\ville', false ),
+                );
+        }
+
+        /**
+         * @dataProvider jsonp_callback_provider
+         */
+        public function test_jsonp_callback_check( $callback, $valid ) {
+                $this->assertEquals( $valid, wp_check_jsonp_callback( $callback ) );
+        }
+
 }