Changeset 63006 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

08/04/2026 07:25:22 AM (2 months ago)

Author:

westonruter

Message:

XML-RPC: Validate the attachment data in mw_newMediaObject().

Passing anything other than a struct as the fourth argument caused a fatal error, and because the struct was read before the login was attempted, an unauthenticated request was enough to trigger it.

Read and validate the struct only once the request is authenticated and the upload_files capability is confirmed, as every other method on the server does, and reject a call with too few arguments using minimum_args(). The name, type and bits members must all be strings: a struct sent for bits reached fwrite() by way of wp_upload_bits() and threw a TypeError, while one sent for type survived sanitize_mime_type() to reach the database as the attachment's post MIME type. A name left empty by sanitize_file_name() is now reported as a malformed request too, rather than as the server failure wp_upload_bits() produced for it.

The fourth argument is expanded into a nested hash in the documentation, covering the previously undocumented post_id member. Tests cover each rejected shape, the optional members that remain tolerated when absent, and the ordering of the login and capability checks ahead of the validation.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/12482.
Follow-up to r32579, r53881.

Props josephscott, westonruter, mukesh27.
See #65600.
Fixes #65611.

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -6441 +6441 @@
          *
          * @param array $args {
-         *     Method arguments. Note: arguments must be ordered as documented.
+         *     Method arguments. Note: top-level arguments must be ordered as documented.
          *
          *     @type int    $0 Blog ID (unused).
          *     @type string $1 Username.
          *     @type string $2 Password.
-         *     @type array  $3 Data.
+         *     @type array  $3 {
+         *         Data for the file to upload.
+         *
+         *         @type string $name    File name. Sanitized with sanitize_file_name().
+         *         @type string $type    Optional. File MIME type, stored as the attachment's
+         *                               post MIME type. Default empty string.
+         *         @type string $bits    Optional. File contents. Default empty string.
+         *         @type int    $post_id Optional. ID of the post to attach the file to.
+         *                               Default 0.
+         *     }
          * }
          * @return array|IXR_Error
          */
         public function mw_newMediaObject( $args ) {
+                if ( ! $this->minimum_args( $args, 4 ) ) {
+                        return $this->error;
+                }
+
                 $username = $this->escape( $args[1] );
                 $password = $this->escape( $args[2] );
                 $data     = $args[3];
 
-                $name = sanitize_file_name( $data['name'] );
-                $type = $data['type'];
-                $bits = $data['bits'];
-
                 $user = $this->login( $username, $password );
                 if ( ! $user ) {
@@ -6471 +6480 @@
                         return $this->error;
                 }
+
+                if (
+                        ! is_array( $data ) ||
+                        ! is_string( $data['name'] ?? null ) ||
+                        ! is_string( $data['type'] ?? '' ) ||
+                        ! is_string( $data['bits'] ?? '' )
+                ) {
+                        return new IXR_Error( 400, __( 'Invalid attachment data.' ) );
+                }
+
+                $name = sanitize_file_name( $data['name'] );
+
+                // A name consisting only of characters the sanitizer strips leaves nothing to write to.
+                if ( '' === $name ) {
+                        return new IXR_Error( 400, __( 'Invalid attachment data.' ) );
+                }
+
+                $type = $data['type'] ?? '';
+                $bits = $data['bits'] ?? '';
 
                 if ( is_multisite() && upload_is_user_over_quota( false ) ) {