Changeset 62619 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

Timestamp:

07/01/2026 09:32:34 PM (3 months ago)

Author:

adamsilverstein

Message:

REST API: Add dimension validation to sideload endpoint.

Validate uploaded image dimensions in the wp/v2/media/<id>/sideload endpoint before metadata is written, ensuring sideloaded files match the requested image_size. A new private validate_image_dimensions() helper on WP_REST_Attachments_Controller enforces:

• The original size must match the original attachment dimensions exactly.
• The full and scaled sizes require positive dimensions only.
• Regular registered sizes must not exceed the registered sub-size maximums, with a 1px tolerance for rounding differences.

Follow-up to [62428].

Props apermo, westonruter.
Fixes #64798.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -2168 +2168 @@
 
         /**
+         * Validates that uploaded image dimensions are appropriate for the specified image size.
+         *
+         * @since 7.1.0
+         *
+         * @param int    $width         Uploaded image width.
+         * @param int    $height        Uploaded image height.
+         * @param string $image_size    The target image size name.
+         * @param int    $attachment_id The attachment ID.
+         * @return true|WP_Error True if valid, WP_Error if invalid.
+         */
+        private function validate_image_dimensions( int $width, int $height, string $image_size, int $attachment_id ) {
+                // All image sizes require positive dimensions.
+                if ( $width <= 0 || $height <= 0 ) {
+                        return new WP_Error(
+                                'rest_upload_invalid_dimensions',
+                                __( 'Uploaded image must have positive dimensions.' ),
+                                array( 'status' => 400 )
+                        );
+                }
+
+                // 'original' size: should match original attachment dimensions.
+                if ( 'original' === $image_size ) {
+                        $metadata = wp_get_attachment_metadata( $attachment_id, true );
+                        if ( is_array( $metadata ) && isset( $metadata['width'], $metadata['height'] ) ) {
+                                $expected_width  = (int) $metadata['width'];
+                                $expected_height = (int) $metadata['height'];
+
+                                if ( $width !== $expected_width || $height !== $expected_height ) {
+                                        return new WP_Error(
+                                                'rest_upload_dimension_mismatch',
+                                                sprintf(
+                                                        /* translators: 1: Actual width, 2: actual height, 3: expected width, 4: expected height. */
+                                                        __( 'Uploaded image dimensions (%1$dx%2$d) do not match original image dimensions (%3$dx%4$d).' ),
+                                                        $width,
+                                                        $height,
+                                                        $expected_width,
+                                                        $expected_height
+                                                ),
+                                                array( 'status' => 400 )
+                                        );
+                                }
+                        }
+                        return true;
+                }
+
+                // 'full' size (PDF thumbnails) and 'scaled': no further constraints.
+                if ( in_array( $image_size, array( 'full', 'scaled' ), true ) ) {
+                        return true;
+                }
+
+                // Regular image sizes: validate against registered size constraints.
+                $registered_sizes = wp_get_registered_image_subsizes();
+
+                if ( ! isset( $registered_sizes[ $image_size ] ) ) {
+                        return new WP_Error(
+                                'rest_upload_unknown_size',
+                                __( 'Unknown image size.' ),
+                                array( 'status' => 400 )
+                        );
+                }
+
+                $size_data  = $registered_sizes[ $image_size ];
+                $max_width  = (int) $size_data['width'];
+                $max_height = (int) $size_data['height'];
+
+                // Validate dimensions don't exceed the registered size maximums.
+                // Allow 1px tolerance for rounding differences.
+                $tolerance = 1;
+
+                if ( $this->dimension_exceeds_max( $width, $max_width, $tolerance ) ) {
+                        return new WP_Error(
+                                'rest_upload_dimension_mismatch',
+                                sprintf(
+                                        /* translators: 1: Image size name, 2: maximum width, 3: actual width. */
+                                        __( 'Uploaded image width (%3$d) exceeds maximum for "%1$s" size (%2$d).' ),
+                                        $image_size,
+                                        $max_width,
+                                        $width
+                                ),
+                                array( 'status' => 400 )
+                        );
+                }
+
+                if ( $this->dimension_exceeds_max( $height, $max_height, $tolerance ) ) {
+                        return new WP_Error(
+                                'rest_upload_dimension_mismatch',
+                                sprintf(
+                                        /* translators: 1: Image size name, 2: maximum height, 3: actual height. */
+                                        __( 'Uploaded image height (%3$d) exceeds maximum for "%1$s" size (%2$d).' ),
+                                        $image_size,
+                                        $max_height,
+                                        $height
+                                ),
+                                array( 'status' => 400 )
+                        );
+                }
+
+                return true;
+        }
+
+        /**
+         * Checks whether a dimension exceeds the maximum allowed value.
+         *
+         * A maximum of zero means the dimension is unconstrained.
+         *
+         * @since 7.1.0
+         *
+         * @param int $value     The actual dimension in pixels.
+         * @param int $max       The maximum allowed dimension in pixels. Zero means no constraint.
+         * @param int $tolerance Pixel tolerance allowed for rounding differences.
+         * @return bool True if the value exceeds the maximum plus tolerance.
+         */
+        private function dimension_exceeds_max( int $value, int $max, int $tolerance ): bool {
+                return $max > 0 && $value > $max + $tolerance;
+        }
+
+        /**
          * Side-loads a media file without creating a new attachment.
          *
@@ -2244 +2361 @@
                 $path = $file['file'];
 
+                /** @var non-empty-string $image_size */
                 $image_size = $request['image_size'];
+
+                /*
+                 * Validate raster sub-sizes before storing them. Source-format companion
+                 * originals (e.g. a HEIC or JXL kept next to its JPEG derivative) are
+                 * exempt: their dimensions are neither validated nor recorded, and the
+                 * source format may not be readable by wp_getimagesize() at all.
+                 */
+                if ( self::IMAGE_SIZE_SOURCE_ORIGINAL !== $image_size ) {
+                        /*
+                         * Read the dimensions up front. A file whose dimensions cannot be
+                         * read is corrupted or an unsupported format and must be rejected
+                         * rather than silently stored with zero dimensions.
+                         */
+                        $size = wp_getimagesize( $path );
+
+                        if ( ! $size ) {
+                                // Clean up the uploaded file.
+                                wp_delete_file( $path );
+                                return new WP_Error(
+                                        'rest_upload_invalid_image',
+                                        __( 'Could not read image dimensions. The file may be corrupted or an unsupported format.' ),
+                                        array( 'status' => 400 )
+                                );
+                        }
+
+                        /*
+                         * Validate the dimensions match the expected size. An array
+                         * $image_size represents multiple registered sizes sharing a single
+                         * file; those are handled by the per-size branch below, so only
+                         * scalar sizes are validated here.
+                         */
+                        if ( ! is_array( $image_size ) ) {
+                                $validation = $this->validate_image_dimensions( $size[0], $size[1], $image_size, $attachment_id );
+                                if ( is_wp_error( $validation ) ) {
+                                        // Clean up the uploaded file.
+                                        wp_delete_file( $path );
+                                        return $validation;
+                                }
+                        }
+                }
 
                 // Build sub-size data to return to the client.