Changeset 50030

Timestamp:

01/27/2021 07:03:42 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

App Passwords: Improve validation and sanitization of the application name.

Application names are now required to be unique and cannot contain solely whitespace characters. Additionally, invalid characters are now stripped from the application name using sanitize_text_field().

Props Boniu91, hellofromTonya, engahmeds3ed, xkon, francina.
Fixes #51941.

Location:

trunk

Files:

• src/js/_enqueues/admin/application-passwords.js (modified) (1 diff)
• src/js/_enqueues/admin/auth-app.js (modified) (1 diff)
• src/wp-includes/class-wp-application-passwords.php (modified) (4 diffs)
• src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/application-passwords.php (added)
• tests/phpunit/tests/rest-api/rest-application-passwords-controller.php (modified) (2 diffs)
• tests/qunit/fixtures/wp-api-generated.js (modified) (2 diffs)

trunk/src/js/_enqueues/admin/application-passwords.js

@@ -58 +58 @@
 
             $newAppPassForm.after( tmplNewAppPass( {
-                name: name,
+                name: response.name,
                 password: response.password
             } ) );

trunk/src/js/_enqueues/admin/auth-app.js

@@ -99 +99 @@
 
                 // We're using .text() to write the variables to avoid any chance of XSS.
-                $( 'strong', $notice ).text( name );
+                $( 'strong', $notice ).text( response.name );
                 $( 'input', $notice ).val( response.password );
 

trunk/src/wp-includes/class-wp-application-passwords.php

@@ -59 +59 @@
      *
      * @since 5.6.0
+     * @since 5.7.0 Returns WP_Error if application name already exists.
      *
      * @param int   $user_id  User ID.
@@ -66 +67 @@
      */
     public static function create_new_application_password( $user_id, $args = array() ) {
+        if ( ! empty( $args['name'] ) ) {
+            $args['name'] = sanitize_text_field( $args['name'] );
+        }
+
         if ( empty( $args['name'] ) ) {
-            return new WP_Error( 'application_password_empty_name', __( 'An application name is required to create an application password.' ) );
+            return new WP_Error( 'application_password_empty_name', __( 'An application name is required to create an application password.' ), array( 'status' => 400 ) );
+        }
+
+        if ( self::application_name_exists_for_user( $user_id, $args['name'] ) ) {
+            return new WP_Error( 'application_password_duplicate_name', __( 'Each application name should be unique.' ), array( 'status' => 409 ) );
         }
 
@@ -164 +173 @@
 
     /**
+     * Check if application name exists before for this user.
+     *
+     * @since 5.7.0
+     *
+     * @param int    $user_id User ID.
+     * @param string $name    Application name.
+     *
+     * @return bool Provided application name exists or not.
+     */
+    public static function application_name_exists_for_user( $user_id, $name ) {
+        $passwords = static::get_user_application_passwords( $user_id );
+
+        foreach ( $passwords as $password ) {
+            if ( strtolower( $password['name'] ) === strtolower( $name ) ) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
      * Updates an application password.
      *
@@ -179 +210 @@
             if ( $item['uuid'] !== $uuid ) {
                 continue;
+            }
+
+            if ( ! empty( $update['name'] ) ) {
+                $update['name'] = sanitize_text_field( $update['name'] );
             }
 

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php

@@ -632 +632 @@
                     'required'    => true,
                     'context'     => array( 'view', 'edit', 'embed' ),
+                    'minLength'   => 1,
+                    'pattern'     => '.*\S.*',
                 ),
                 'password'  => array(

trunk/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php

@@ -539 +539 @@
     /**
      * @ticket 51583
+     * @ticket 51941
      */
     public function test_update_item_cannot_overwrite_app_id() {
@@ -555 +556 @@
             self::$admin,
             array(
-                'name'   => 'App',
+                'name'   => 'App 2',
                 'app_id' => $app_id,
             )

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -4975 +4975 @@
                             "description": "The name of the application password.",
                             "type": "string",
+                            "minLength": 1,
+                            "pattern": ".*\\S.*",
                             "required": true
                         }
@@ -5031 +5033 @@
                             "description": "The name of the application password.",
                             "type": "string",
+                            "minLength": 1,
+                            "pattern": ".*\\S.*",
                             "required": false
                         }