Changeset 57496 for trunk/src/wp-includes/class-wp-theme-json.php

Timestamp:

01/31/2024 10:53:48 AM (17 months ago)

Author:

youknowriad

Message:

Editor: Sanitize nested array in theme.json properly.

WP_Theme_JSON sanitization is now able to sanitize data contained on indexed arrays.
So certain data from theme.json, for example, settings.typography.fontFamilies which is a JSON array will be sanitized.

Props mmaattiiaass, mukesh27.
Fixes #60360.

File:

• trunk/src/wp-includes/class-wp-theme-json.php (modified) (5 diffs)

trunk/src/wp-includes/class-wp-theme-json.php

@@ -430 +430 @@
     );
 
+    /*
+     * The valid properties for fontFamilies under settings key.
+     *
+     * @since 6.5.0
+     *
+     * @var array
+     */
+    const FONT_FAMILY_SCHEMA = array(
+        array(
+            'fontFamily' => null,
+            'name'       => null,
+            'slug'       => null,
+            'fontFace'   => array(
+                array(
+                    'ascentOverride'        => null,
+                    'descentOverride'       => null,
+                    'fontDisplay'           => null,
+                    'fontFamily'            => null,
+                    'fontFeatureSettings'   => null,
+                    'fontStyle'             => null,
+                    'fontStretch'           => null,
+                    'fontVariationSettings' => null,
+                    'fontWeight'            => null,
+                    'lineGapOverride'       => null,
+                    'sizeAdjust'            => null,
+                    'src'                   => null,
+                    'unicodeRange'          => null,
+                ),
+            ),
+        ),
+    );
+
     /**
      * The valid properties under the styles key.
@@ -558 +590 @@
 
     /**
+     * Return the input schema at the root and per origin.
+     *
+     * @since 6.5.0
+     *
+     * @param array $schema The base schema.
+     * @return array The schema at the root and per origin.
+     *
+     * Example:
+     * schema_in_root_and_per_origin(
+     *   array(
+     *    'fontFamily' => null,
+     *    'slug' => null,
+     *   )
+     * )
+     *
+     * Returns:
+     * array(
+     *  'fontFamily' => null,
+     *  'slug' => null,
+     *  'default' => array(
+     *    'fontFamily' => null,
+     *    'slug' => null,
+     *  ),
+     *  'blocks' => array(
+     *    'fontFamily' => null,
+     *    'slug' => null,
+     *  ),
+     *  'theme' => array(
+     *     'fontFamily' => null,
+     *     'slug' => null,
+     *  ),
+     *  'custom' => array(
+     *     'fontFamily' => null,
+     *     'slug' => null,
+     *  ),
+     * )
+     */
+    protected static function schema_in_root_and_per_origin( $schema ) {
+        $schema_in_root_and_per_origin = $schema;
+        foreach ( static::VALID_ORIGINS as $origin ) {
+            $schema_in_root_and_per_origin[ $origin ] = $schema;
+        }
+        return $schema_in_root_and_per_origin;
+    }
+
+    /**
      * Returns a class name by an element name.
      *
@@ -798 +876 @@
         }
 
-        $schema['styles']             = static::VALID_STYLES;
-        $schema['styles']['blocks']   = $schema_styles_blocks;
-        $schema['styles']['elements'] = $schema_styles_elements;
-        $schema['settings']           = static::VALID_SETTINGS;
-        $schema['settings']['blocks'] = $schema_settings_blocks;
+        $schema['styles']                                 = static::VALID_STYLES;
+        $schema['styles']['blocks']                       = $schema_styles_blocks;
+        $schema['styles']['elements']                     = $schema_styles_elements;
+        $schema['settings']                               = static::VALID_SETTINGS;
+        $schema['settings']['blocks']                     = $schema_settings_blocks;
+        $schema['settings']['typography']['fontFamilies'] = static::schema_in_root_and_per_origin( static::FONT_FAMILY_SCHEMA );
 
         // Remove anything that's not present in the schema.
@@ -975 +1054 @@
      */
     protected static function remove_keys_not_in_schema( $tree, $schema ) {
-        $tree = array_intersect_key( $tree, $schema );
-
-        foreach ( $schema as $key => $data ) {
-            if ( ! isset( $tree[ $key ] ) ) {
+        if ( ! is_array( $tree ) ) {
+            return $tree;
+        }
+
+        foreach ( $tree as $key => $value ) {
+            // Remove keys not in the schema or with null/empty values.
+            if ( ! array_key_exists( $key, $schema ) ) {
+                unset( $tree[ $key ] );
                 continue;
             }
 
-            if ( is_array( $schema[ $key ] ) && is_array( $tree[ $key ] ) ) {
-                $tree[ $key ] = static::remove_keys_not_in_schema( $tree[ $key ], $schema[ $key ] );
-
-                if ( empty( $tree[ $key ] ) ) {
-                    unset( $tree[ $key ] );
+            // Check if the value is an array and requires further processing.
+            if ( is_array( $value ) && is_array( $schema[ $key ] ) ) {
+                // Determine if it is an associative or indexed array.
+                $schema_is_assoc = self::is_assoc( $value );
+
+                if ( $schema_is_assoc ) {
+                    // If associative, process as a single object.
+                    $tree[ $key ] = self::remove_keys_not_in_schema( $value, $schema[ $key ] );
+
+                    if ( empty( $tree[ $key ] ) ) {
+                        unset( $tree[ $key ] );
+                    }
+                } else {
+                    // If indexed, process each item in the array.
+                    foreach ( $value as $item_key => $item_value ) {
+                        if ( isset( $schema[ $key ][0] ) && is_array( $schema[ $key ][0] ) ) {
+                            $tree[ $key ][ $item_key ] = self::remove_keys_not_in_schema( $item_value, $schema[ $key ][0] );
+                        } else {
+                            // If the schema does not define a further structure, keep the value as is.
+                            $tree[ $key ][ $item_key ] = $item_value;
+                        }
+                    }
                 }
             } elseif ( is_array( $schema[ $key ] ) && ! is_array( $tree[ $key ] ) ) {
@@ -994 +1094 @@
 
         return $tree;
+    }
+
+    /**
+     * Checks if the given array is associative.
+     *
+     * @since 6.5.0
+     * @param array $data The array to check.
+     * @return bool True if the array is associative, false otherwise.
+     */
+    protected static function is_assoc( $data ) {
+        if ( array() === $data ) {
+            return false;
+        }
+        return array_keys( $data ) !== range( 0, count( $data ) - 1 );
     }