Permission Check Mismatch Due to Unnormalized Ability Input

[utsav72640]

While reviewing the WP_REST_Abilities_V1_Run_Controller code, I noticed that the request input is handled differently during the permission check and the actual execution.

The check_ability_permissions() method normalizes the input before validating it and checking permissions. However, execute_ability() reads the request input again and passes it directly to execute() without normalizing it first.

Because of this, both methods can end up working with different input values.
For example, if an ability has default values defined in its input schema and the request does not include any input, the permission check uses the normalized default values, while execute() receives null.

I believe both permission checking and execution should use the same normalized input to ensure consistent behavior and avoid unexpected issues during execution.

[utsav72640]

wp-includes\rest-api\endpoints\class-wp-rest-abilities-v1-run-controller.php

[utsav72640]

I have attached a new diff file. Please ignore the previous one, as it was incorrect.

[wildworks]

Thanks for the report. As far as I could research, the current behavior should have been occurring since version 6.9 when the Abilities API was introduced.

However, execute_ability() reads the request input again and passes it directly to execute() without normalizing it first.

I don't think this is accurate. While it's true that ​the REST controller doesn't normalize input values before executing, the WP_Ability class normalizes them ​here.