Strict mode for REST API endpoints

[danielbachhuber]

Although register_rest_route() supports registering arguments, and validation / sanitization callbacks for those arguments, a WP_REST_Request object ends up with all request data, not limited to registered arguments appropriately validated and sanitized.

For endpoint developers concerned with invalid or unsanitized data leaking through, we should offer a REST API strict mode. If a route is registered with strict mode, arguments would be required to have a validation or sanitization callback, and only registered, validated, and sanitized arguments would be present on the WP_REST_Request object.

Originally ​https://github.com/WP-API/WP-API/issues/1223

[rmccue]

IMO, we might want to keep this in plugin territory to avoid complicating the core infrastructure further. I think it's mainly useful as a development tool.

[danielbachhuber]

Feature plugin works for me.

[rmccue]

#34725 was marked as a duplicate.