Make WordPress Core

Opened 3 years ago

Closed 2 years ago

#54527 closed defect (bug) (reported-upstream)

missing self-URL check in RSS block

Reported by: anonymized_17880307's profile anonymized_17880307 Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Editor Keywords:
Focuses: Cc:

Description

At https://github.com/WordPress/WordPress/blob/5.8.2/wp-includes/widgets/class-wp-widget-rss.php#L48-L64 there is a check to prevent that the home / site_url URL is accidentally used as RSS feed URL as this can lead to interesting cases like infinite loops, many long-running http requests and some sort of "Self" Denial of Service (DoS).

In WordPress 5.8.2 when we edit block-enabled them and add the RSS widget and use the same URL like home / site_url, then we get the mentioned problems because the check is missing there:
https://github.com/WordPress/WordPress/blob/5.8.2/wp-includes/blocks/rss.php#L16

Change History (4)

#1 @anonymized_17880307
3 years ago

  • Summary changed from missing to missing self-URL check in RSS block

#2 follow-up: @SergeyBiryukov
2 years ago

  • Component changed from Widgets to Editor

Hi there, welcome back to WordPress Trac! Thanks for the report.

Moving this to the Editor component for more visibility, as it seems to be more related to the RSS block than the RSS widget.

Also noting that this needs to be fixed in the block-library package upstream and then backported to core. Could you create an issue or PR at https://github.com/WordPress/gutenberg? Thanks!

#3 in reply to: ↑ 2 @anonymized_17880307
2 years ago

Replying to SergeyBiryukov:

Hi there, welcome back to WordPress Trac! Thanks for the report.

Moving this to the Editor component for more visibility, as it seems to be more related to the RSS block than the RSS widget.

Also noting that this needs to be fixed in the block-library package upstream and then backported to core. Could you create an issue or PR at https://github.com/WordPress/gutenberg? Thanks!

Done, you can find the issue at https://github.com/WordPress/gutenberg/issues/36969

#4 @sabernhardt
2 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to reported-upstream
  • Status changed from new to closed

Thanks for re-reporting this on GitHub!

Note: See TracTickets for help on using tickets.