Ticket #36419: 36419.diff

src/wp-includes/rest-api/class-wp-rest-server.php

@@ -303 +303 @@
 
                 $request = new WP_REST_Request( $_SERVER['REQUEST_METHOD'], $path );
 
-                $request->set_query_params( $_GET );
-                $request->set_body_params( $_POST );
+                $request->set_query_params( wp_unslash( $_GET ) );
+                $request->set_body_params( wp_unslash( $_POST ) );
                 $request->set_file_params( $_FILES );
-                $request->set_headers( $this->get_headers( $_SERVER ) );
+                $request->set_headers( $this->get_headers( wp_unslash( $_SERVER ) ) );
                 $request->set_body( $this->get_raw_data() );
 
                 /*

tests/phpunit/includes/spy-rest-server.php

@@ -4 +4 @@
 
         public $sent_headers = array();
         public $sent_body = '';
+        public $last_request = null;
 
         /**
          * Get the raw $endpoints data from the server
@@ -29 +30 @@
                 $this->sent_headers[ $header ] = $value;
         }
 
+        /**
+         * Override the dispatch method so we can get a handle on the request object.
+         *
+         * @param  WP_REST_Request $request
+         * @return WP_REST_Response Response returned by the callback.
+         */
+        public function dispatch( $request ) {
+                $this->last_request = $request;
+                return parent::dispatch( $request );
+        }
+
         public function serve_request( $path = null ) {
 
                 ob_start();

tests/phpunit/tests/rest-api/rest-server.php

@@ -743 +743 @@
                 }
         }
 
+        public function test_serve_request_url_params_are_unslashed() {
+
+                $this->server->register_route( 'test', '/test/(?P<data>.*)', array(
+                        array(
+                                'methods'  => WP_REST_Server::READABLE,
+                                'callback' => '__return_false',
+                                'args'     => array(
+                                        'data' => array(),
+                                ),
+                        ),
+                ) );
+
+                $result = $this->server->serve_request( '/test/data\\with\\slashes' );
+                $url_params = $this->server->last_request->get_url_params();
+                $this->assertEquals( 'data\\with\\slashes', $url_params['data'] );
+        }
+
+        public function test_serve_request_query_params_are_unslashed() {
+
+                $this->server->register_route( 'test', '/test', array(
+                        array(
+                                'methods'  => WP_REST_Server::READABLE,
+                                'callback' => '__return_false',
+                                'args'     => array(
+                                        'data' => array(),
+                                ),
+                        ),
+                ) );
+
+                // WordPress internally will slash the superglobals on bootstrap
+                $_GET = wp_slash( array(
+                        'data' => 'data\\with\\slashes',
+                ) );
+
+                $result = $this->server->serve_request( '/test' );
+                $query_params = $this->server->last_request->get_query_params();
+                $this->assertEquals( 'data\\with\\slashes', $query_params['data'] );
+        }
+
+        public function test_serve_request_body_params_are_unslashed() {
+
+                $this->server->register_route( 'test', '/test', array(
+                        array(
+                                'methods'  => WP_REST_Server::READABLE,
+                                'callback' => '__return_false',
+                                'args'     => array(
+                                        'data' => array(),
+                                ),
+                        ),
+                ) );
+
+                // WordPress internally will slash the superglobals on bootstrap
+                $_POST = wp_slash( array(
+                        'data' => 'data\\with\\slashes',
+                ) );
+
+                $result = $this->server->serve_request( '/test/data' );
+
+                $body_params = $this->server->last_request->get_body_params();
+                $this->assertEquals( 'data\\with\\slashes', $body_params['data'] );
+        }
+
+        public function test_serve_request_json_params_are_unslashed() {
+
+                $this->server->register_route( 'test', '/test', array(
+                        array(
+                                'methods'  => WP_REST_Server::READABLE,
+                                'callback' => '__return_false',
+                                'args'     => array(
+                                        'data' => array(),
+                                ),
+                        ),
+                ) );
+
+                $_SERVER['HTTP_CONTENT_TYPE'] = 'application/json';
+                $GLOBALS['HTTP_RAW_POST_DATA'] = json_encode( array(
+                        'data' => 'data\\with\\slashes',
+                ) );
+
+                $result = $this->server->serve_request( '/test' );
+                $json_params = $this->server->last_request->get_json_params();
+                $this->assertEquals( 'data\\with\\slashes', $json_params['data'] );
+        }
+
+        public function test_serve_request_file_params_are_unslashed() {
+
+                $this->server->register_route( 'test', '/test', array(
+                        array(
+                                'methods'  => WP_REST_Server::READABLE,
+                                'callback' => '__return_false',
+                                'args'     => array(
+                                        'data' => array(),
+                                ),
+                        ),
+                ) );
+
+                // WordPress internally will slash the superglobals on bootstrap
+                $_FILES = array(
+                        'data' => array(
+                                'name' => 'data\\with\\slashes',
+                        ),
+                );
+
+                $result = $this->server->serve_request( '/test/data\\with\\slashes' );
+                $file_params = $this->server->last_request->get_file_params();
+                $this->assertEquals( 'data\\with\\slashes', $file_params['data']['name'] );
+        }
+
+        public function test_serve_request_headers_are_unslashed() {
+
+                $this->server->register_route( 'test', '/test', array(
+                        array(
+                                'methods'  => WP_REST_Server::READABLE,
+                                'callback' => '__return_false',
+                                'args'     => array(
+                                        'data' => array(),
+                                ),
+                        ),
+                ) );
+
+                // WordPress internally will slash the superglobals on bootstrap
+                $_SERVER['HTTP_X_MY_HEADER'] = wp_slash( 'data\\with\\slashes' );
+
+                $result = $this->server->serve_request( '/test/data\\with\\slashes' );
+                $this->assertEquals( 'data\\with\\slashes', $this->server->last_request->get_header( 'x_my_header') );
+        }
+
         public function filter_wp_rest_server_class() {
                 return 'Spy_REST_Server';
         }