Changeset 42000 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php

Timestamp:

10/24/2017 09:04:50 PM (8 years ago)

Author:

joehoyle

Message:

REST API: Don’t remove unregistered properties from objects in schema.

In r41727 the ability to sanitise and validate objects from JSON schema was added, with a whitelist approach. It was decided we should pass through all non-registered properties to reflect the behaviour of the root object in register_rest_route. To prevent arbitrary extra data via setting objects, we force additionalProperties to false in the settings endpoint.

See #38583.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php

@@ -249 +249 @@
             }
 
+            $rest_args['schema'] = $this->set_additional_properties_to_false( $rest_args['schema'] );
+
             $rest_options[ $rest_args['name'] ] = $rest_args;
         }
@@ -302 +304 @@
         return rest_parse_request_arg( $value, $request, $param );
     }
+
+    /**
+     * Recursively add additionalProperties = false to all objects in a schema.
+     *
+     * This is need to restrict properties of objects in settings values to only
+     * registered items, as the REST API will allow additional properties by
+     * default.
+     *
+     * @since 4.9.0
+     *
+     * @param array $schema The schema array.
+     * @return array
+     */
+    protected function set_additional_properties_to_false( $schema ) {
+        switch ( $schema['type'] ) {
+            case 'object':
+                foreach ( $schema['properties'] as $key => $child_schema ) {
+                    $schema['properties'][ $key ] = $this->set_additional_properties_to_false( $child_schema );
+                }
+                $schema['additionalProperties'] = false;
+                break;
+            case 'array':
+                $schema['items'] = $this->set_additional_properties_to_false( $schema['items'] );
+                break;
+        }
+
+        return $schema;
+    }
 }