Skip to content

Commit 01e2c46

Browse files
tijmenbruggemantijmenbruggeman
authored
PHPCS - WordPress.Security.ValidatedSanitizedInput (#112)
* PHPCS - WordPress.Security.EscapeOutput (#110) * autofixes * remove prefix underscores * fix spacing in resize text * move whitespace * Do not escale error messages before being outputted to html * Unexclude escape output * phpcs: bulk-optimization.php * phpcs account-status-create-advanced * phpcs compress-details-processing * fix create-simpel * phpcs dashboard-widget * phpcs optimization-chart * phpcs status-connected * phpcs compress-details * phpcs upgrade notice * notice-feedback * exceptions are handled on client usage in views * phpcs notices * phpcs class-tiny-compress.php * phpcs settings * phpcs tiny-plugin * remove parameter * use Tiny_Image * typo * ignore exception, is not outputted * use esc_url instead of esc_html on urls * add checked mock func * fix test * enable sanitization sniff * sanitize and unslash ids * sanitize notice name * autoformat * parse getter * sanitize and unslash on register * unslash and sanitize update api key * sanitize media library bulk action * sanitize rpc request * sanitize compress_image_for_bulk * replace sanitize_key with sanitize_text_field due to lowercasing
1 parent 3f71599 commit 01e2c46

5 files changed

Lines changed: 56 additions & 27 deletions

File tree

‎phpcs.xml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
<exclude name="Squiz.PHP.CommentedOutCode.Found" />
1212

1313
<!-- Fix security issues -->
14-
<exclude name="WordPress.Security.ValidatedSanitizedInput" />
1514
<exclude name="WordPress.Security.NonceVerification" />
1615

1716
<!-- Fix AlternativeFunctons-->

‎src/class-tiny-notices.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,8 @@ public function dismiss() {
153153
exit();
154154
}
155155
$this->load_dismissals();
156-
$this->dismissals[ $_POST['name'] ] = true;
156+
$notice_name = sanitize_key( wp_unslash( $_POST['name'] ) );
157+
$this->dismissals[ $notice_name ] = true;
157158
$this->save_dismissals();
158159
echo json_encode( true );
159160
exit();

‎src/class-tiny-plugin.php‎

Lines changed: 40 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -437,15 +437,18 @@ public function async_compress_on_upload( $metadata, $attachment_id ) {
437437
public function process_rpc_request() {
438438
if (
439439
empty( $_POST['tiny_rpc_action'] ) ||
440-
empty( $_POST['tiny_rpc_hash'] ) ||
441-
32 !== strlen( $_POST['tiny_rpc_hash'] )
440+
empty( $_POST['tiny_rpc_hash'] )
442441
) {
443442
exit();
444443
}
445444

446-
$rpc_hash = sanitize_key( $_POST['tiny_rpc_hash'] );
447-
$user_id = absint( get_transient( 'tiny_rpc_' . $rpc_hash ) );
448-
$user = $user_id ? get_userdata( $user_id ) : false;
445+
$rpc_hash = sanitize_key( wp_unslash( $_POST['tiny_rpc_hash'] ) );
446+
if ( 32 !== strlen( $rpc_hash ) ) {
447+
exit();
448+
}
449+
450+
$user_id = absint( get_transient( 'tiny_rpc_' . $rpc_hash ) );
451+
$user = $user_id ? get_userdata( $user_id ) : false;
449452

450453
/* We no longer need the transient. */
451454
delete_transient( 'tiny_rpc_' . $rpc_hash );
@@ -460,7 +463,7 @@ public function process_rpc_request() {
460463
}
461464

462465
/* Now that everything is checked, perform the actual action. */
463-
$action = $_POST['tiny_rpc_action'];
466+
$action = sanitize_key( wp_unslash( $_POST['tiny_rpc_action'] ) );
464467
unset(
465468
$_POST['action'],
466469
$_POST['tiny_rpc_action'],
@@ -471,12 +474,17 @@ public function process_rpc_request() {
471474
}
472475

473476
public function compress_on_upload() {
474-
if ( ! wp_verify_nonce( $_POST['_ajax_nonce'], 'new_media-' . $_POST['attachment_id'] ) ) {
477+
$nonce = isset( $_POST['_ajax_nonce'] ) ?
478+
sanitize_key( wp_unslash( $_POST['_ajax_nonce'] ) ) : '';
479+
$attachment_id = isset( $_POST['attachment_id'] ) ?
480+
intval( wp_unslash( $_POST['attachment_id'] ) ) : 0;
481+
482+
if ( ! wp_verify_nonce( $nonce, 'new_media-' . $attachment_id ) ) {
475483
exit;
476484
}
477485
if ( current_user_can( 'upload_files' ) ) {
478-
$attachment_id = intval( $_POST['attachment_id'] );
479-
$metadata = $_POST['metadata'];
486+
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
487+
$metadata = isset( $_POST['metadata'] ) ? wp_unslash( $_POST['metadata'] ) : array();
480488
if ( is_array( $metadata ) ) {
481489
$tiny_image = new Tiny_Image( $this->settings, $attachment_id, $metadata );
482490

@@ -606,7 +614,9 @@ public function compress_image_for_bulk() {
606614
);
607615
wp_update_attachment_metadata( $id, $tiny_image->get_wp_metadata() );
608616

609-
$current_library_size = intval( $_POST['current_size'] );
617+
$current_library_size = isset( $_POST['current_size'] ) ?
618+
intval( wp_unslash( $_POST['current_size'] ) )
619+
: 0;
610620
$size_after = $image_statistics['compressed_total_size'];
611621
$new_library_size = $current_library_size + $size_after - $size_before;
612622

@@ -670,33 +680,46 @@ public function ajax_compression_status() {
670680

671681
public function media_library_bulk_action() {
672682
$valid_actions = array( 'tiny_bulk_action', 'tiny_bulk_mark_compressed' );
673-
$action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';
674-
$action2 = isset( $_REQUEST['action2'] ) ? $_REQUEST['action2'] : '';
683+
$action = isset( $_REQUEST['action'] ) ?
684+
sanitize_key( wp_unslash( $_REQUEST['action'] ) ) : '';
685+
$action2 = isset( $_REQUEST['action2'] ) ?
686+
sanitize_key( wp_unslash( $_REQUEST['action2'] ) ) : '';
675687

676688
if (
677689
! in_array( $action, $valid_actions, true ) &&
678690
! in_array( $action2, $valid_actions, true )
679691
) {
680692
return;
681693
}
682-
if ( empty( $_REQUEST['media'] ) || ( ! $_REQUEST['media'] ) ) {
694+
$media = isset( $_REQUEST['media'] ) ?
695+
array_map( 'intval', wp_unslash( (array) $_REQUEST['media'] ) )
696+
: array();
697+
if ( empty( $media ) ) {
683698
$_REQUEST['action'] = '';
684699
return;
685700
}
686701
check_admin_referer( 'bulk-media' );
687-
$ids = implode( '-', array_map( 'intval', $_REQUEST['media'] ) );
702+
$ids = implode( '-', $media );
688703
$location = 'upload.php?mode=list&ids=' . $ids;
689704

690-
$location = add_query_arg( 'action', $_REQUEST['action'], $location );
705+
$location = add_query_arg( 'action', $action, $location );
691706

692707
if ( ! empty( $_REQUEST['paged'] ) ) {
693708
$location = add_query_arg( 'paged', absint( $_REQUEST['paged'] ), $location );
694709
}
695710
if ( ! empty( $_REQUEST['s'] ) ) {
696-
$location = add_query_arg( 's', $_REQUEST['s'], $location );
711+
$location = add_query_arg(
712+
's',
713+
sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ),
714+
$location
715+
);
697716
}
698717
if ( ! empty( $_REQUEST['m'] ) ) {
699-
$location = add_query_arg( 'm', $_REQUEST['m'], $location );
718+
$location = add_query_arg(
719+
'm',
720+
sanitize_text_field( wp_unslash( $_REQUEST['m'] ) ),
721+
$location
722+
);
700723
}
701724

702725
wp_safe_redirect( admin_url( $location ) );

‎src/class-tiny-settings.php‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,10 @@ public function add_options_to_page() {
161161

162162
public function image_sizes_notice() {
163163
if ( current_user_can( 'manage_options' ) ) {
164+
$selected_sizes = isset( $_GET['image_sizes_selected'] ) ?
165+
intval( $_GET['image_sizes_selected'] ) : 0;
164166
$this->render_size_checkboxes_description(
165-
$_GET['image_sizes_selected'],
167+
$selected_sizes,
166168
isset( $_GET['resize_original'] ),
167169
isset( $_GET['compress_wr2x'] ),
168170
self::get_conversion_enabled()
@@ -835,7 +837,7 @@ public function create_api_key() {
835837
'message' => 'This feature requires certain user capabilities',
836838
);
837839
} elseif ( $compressor->can_create_key() ) {
838-
if ( ! isset( $_POST['name'] ) || ! $_POST['name'] ) {
840+
if ( empty( $_POST['name'] ) ) {
839841
$status = (object) array(
840842
'ok' => false,
841843
'message' => __(
@@ -847,7 +849,7 @@ public function create_api_key() {
847849
exit();
848850
}
849851

850-
if ( ! isset( $_POST['email'] ) || ! $_POST['email'] ) {
852+
if ( empty( $_POST['email'] ) ) {
851853
$status = (object) array(
852854
'ok' => false,
853855
'message' => __(
@@ -868,9 +870,9 @@ public function create_api_key() {
868870
$identifier = 'WordPress plugin for ' . $site;
869871
$link = $this->get_absolute_url();
870872
$compressor->create_key(
871-
$_POST['email'],
873+
sanitize_email( wp_unslash( $_POST['email'] ) ),
872874
array(
873-
'name' => $_POST['name'],
875+
'name' => sanitize_text_field( wp_unslash( $_POST['name'] ) ),
874876
'identifier' => $identifier,
875877
'link' => $link,
876878
)
@@ -903,24 +905,27 @@ public function create_api_key() {
903905
}
904906

905907
public function update_api_key() {
906-
$key = $_POST['key'];
907908
if ( ! $this->check_ajax_referer() ) {
908909
exit;
909910
}
911+
912+
$key = null;
910913
if ( ! current_user_can( 'manage_options' ) ) {
911914
$status = (object) array(
912915
'ok' => false,
913916
'message' => 'This feature requires certain user capabilities',
914917
);
915-
} elseif ( empty( $key ) ) {
918+
} elseif ( empty( $_POST['key'] ) ) {
916919
/* Always save if key is blank, so the key can be deleted. */
917920
$status = (object) array(
918921
'ok' => true,
919922
'message' => null,
920923
);
921924
} else {
925+
$key = sanitize_text_field( wp_unslash( $_POST['key'] ) );
922926
$status = Tiny_Compress::create( $key )->get_status();
923927
}
928+
924929
if ( $status->ok ) {
925930
update_option( self::get_prefixed_name( 'api_key_pending' ), false );
926931
update_option( self::get_prefixed_name( 'api_key' ), $key );

‎src/views/compress-details.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@
2424

2525
$images_to_compress = array();
2626
if ( ! empty( $_REQUEST['ids'] ) ) {
27-
$images_to_compress = array_map( 'intval', explode( '-', $_REQUEST['ids'] ) );
27+
$request_ids = sanitize_text_field( wp_unslash( $_REQUEST['ids'] ) );
28+
$images_to_compress = array_map( 'intval', explode( '-', $request_ids ) );
2829
}
2930
?>
3031
<div class="details-container">

0 commit comments

Comments
 (0)