Changeset 42000 for trunk/src/wp-includes/rest-api.php

Timestamp:

10/24/2017 09:04:50 PM (7 years ago)

Author:

joehoyle

Message:

REST API: Don’t remove unregistered properties from objects in schema.

In r41727 the ability to sanitise and validate objects from JSON schema was added, with a whitelist approach. It was decided we should pass through all non-registered properties to reflect the behaviour of the root object in register_rest_route. To prevent arbitrary extra data via setting objects, we force additionalProperties to false in the settings endpoint.

See #38583.

File:

• trunk/src/wp-includes/rest-api.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api.php

@@ -1107 +1107 @@
 
         foreach ( $value as $property => $v ) {
-            if ( ! isset( $args['properties'][ $property ] ) ) {
-                continue;
-            }
-            $is_valid = rest_validate_value_from_schema( $v, $args['properties'][ $property ], $param . '[' . $property . ']' );
-
-            if ( is_wp_error( $is_valid ) ) {
-                return $is_valid;
+            if ( isset( $args['properties'][ $property ] ) ) {
+                $is_valid = rest_validate_value_from_schema( $v, $args['properties'][ $property ], $param . '[' . $property . ']' );
+                if ( is_wp_error( $is_valid ) ) {
+                    return $is_valid;
+                }
+            } elseif ( isset( $args['additionalProperties'] ) && false === $args['additionalProperties'] ) {
+                return new WP_Error( 'rest_invalid_param', sprintf( __( '%1$s is not a valid property of Object.' ), $property ) );
             }
         }
@@ -1247 +1247 @@
 
         foreach ( $value as $property => $v ) {
-            if ( ! isset( $args['properties'][ $property ] ) ) {
+            if ( isset( $args['properties'][ $property ] ) ) {
+                $value[ $property ] = rest_sanitize_value_from_schema( $v, $args['properties'][ $property ] );
+            } elseif ( isset( $args['additionalProperties'] ) && false === $args['additionalProperties'] ) {
                 unset( $value[ $property ] );
-                continue;
             }
-            $value[ $property ] = rest_sanitize_value_from_schema( $v, $args['properties'][ $property ] );
         }