Context Navigation

Changeset 57754

Timestamp:

03/02/2024 02:11:53 PM (9 months ago)

Author:

swissspidy

Message:

Editor: do not expose protected post meta fields in block bindings.

Ignores meta keys which are considered protected or not registered to be shown in the REST API. Adds tests.

Props santosguillamot, swissspidy, gziolo, xknown, peterwilsoncc.
Fixes #60651.

Location:

trunk

Files:

-                      r57641
+                      r57754
+    }
+    // Check if the meta field is protected.
+    if ( is_protected_meta( $source_args['key'], 'post' ) ) {
+        return null;
+    }
+    // Check if the meta field is registered to be shown in REST.
+    $meta_keys = get_registered_meta_keys( 'post', $block_instance->context['postType'] );
+    // Add fields registered for all subtypes.
+    $meta_keys = array_merge( $meta_keys, get_registered_meta_keys( 'post', '' ) );
+    if ( empty( $meta_keys[ $source_args['key'] ]['show_in_rest'] ) ) {
+        return null;
+    }
     return get_post_meta( $post_id, $source_args['key'], true );
+}

-                      r57641
+                      r57754
         );
+    }
+    /**
+     * Tests if the block content is sanitized when unsafe HTML is passed.
+     *
+     * @ticket 60651
+     *
+     * @covers ::register_block_bindings_source
+     */
+    public function test_source_value_with_unsafe_html_is_sanitized() {
+        $get_value_callback = function () {
+            return '<script>alert("Unsafe HTML")</script>';
+        };
+        register_block_bindings_source(
+            self::SOURCE_NAME,
+            array(
+                'label'              => self::SOURCE_LABEL,
+                'get_value_callback' => $get_value_callback,
+            )
+        );
+        $block_content = <<<HTML
+<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"test/source"}}}} -->
+<p>This should not appear</p>
+<!-- /wp:paragraph -->
+HTML;
+        $parsed_blocks = parse_blocks( $block_content );
+        $block         = new WP_Block( $parsed_blocks[0] );
+        $result        = $block->render();
+        $this->assertSame(
+            '<p>alert("Unsafe HTML")</p>',
+            trim( $result ),
+            'The block content should be updated with the value returned by the source.'
+        );
+    }
+}

Note: See TracChangeset for help on using the changeset viewer.