Changeset 58022

Timestamp:

04/18/2024 03:15:50 AM (4 months ago)

Author:

peterwilsoncc

Message:

Upgrade/Install: Validate source & destination values in WP_Ugrader.

Adds a missing string and some additional validation of paths in the upgrader class.

Follow up to [56992].

Props costdev, jipmoors, karlijnbok, swissspidy, afragen, mukesh27.
Fixes #59712.

Location:

trunk

Files:

• src/wp-admin/includes/class-wp-upgrader.php (modified) (2 diffs)
• tests/phpunit/tests/admin/wpUpgrader.php (modified) (3 diffs)

trunk/src/wp-admin/includes/class-wp-upgrader.php

@@ -197 +197 @@
         $this->strings['fs_no_folder'] = __( 'Unable to locate needed folder (%s).' );
 
+
         $this->strings['download_failed']      = __( 'Download failed.' );
         $this->strings['installing_package']   = __( 'Installing the latest version…' );
@@ -528 +529 @@
         }
 
-        if ( empty( $source ) || empty( $destination ) ) {
+        if (
+            ( ! is_string( $source ) || '' === $source || trim( $source ) !== $source ) ||
+            ( ! is_string( $destination ) || '' === $destination || trim( $destination ) !== $destination )
+        ) {
             return new WP_Error( 'bad_request', $this->strings['bad_request'] );
         }

trunk/tests/phpunit/tests/admin/wpUpgrader.php

@@ -138 +138 @@
                 'fs_no_themes_dir',
                 'fs_no_folder',
+
                 'download_failed',
                 'installing_package',
@@ -778 +779 @@
     public function data_install_package_invalid_paths() {
         return array(
-            'empty string' => array( 'path' => '' ),
+            'empty string' => array( 'path' => '' ),
 
             // Type checks.
-            'empty array'  => array( 'path' => array() ),
-            '(int) 0'      => array( 'path' => 0 ),
-            '(int) -0'     => array( 'path' => -0 ),
-            '(float) 0.0'  => array( 'path' => 0.0 ),
-            '(float) -0.0' => array( 'path' => -0.0 ),
-            '(bool) false' => array( 'path' => false ),
-            'null'         => array( 'path' => null ),
+            'empty array'                    => array( 'path' => array() ),
+            'populated array'                => array( 'path' => array( '/' ) ),
+            '(int) 0'                        => array( 'path' => 0 ),
+            '(int) -0'                       => array( 'path' => -0 ),
+            '(int) -1'                       => array( 'path' => -1 ),
+            '(int) 1'                        => array( 'path' => 1 ),
+            '(float) 0.0'                    => array( 'path' => 0.0 ),
+            '(float) -0.0'                   => array( 'path' => -0.0 ),
+            '(float) 1.0'                    => array( 'path' => 1.0 ),
+            '(float) -1.0'                   => array( 'path' => -1.0 ),
+            '(bool) false'                   => array( 'path' => false ),
+            '(bool) true'                    => array( 'path' => true ),
+            'null'                           => array( 'path' => null ),
+            'empty object'                   => array( 'path' => new stdClass() ),
+            'populated object'               => array( 'path' => (object) array( '/' ) ),
+
+            // Ensures that `trim()` is run triggering an empty array.
+            'a string with spaces'           => array( 'path' => '   ' ),
+            'a string with tabs'             => array( 'path' => "\t\t" ),
+            'a string with new lines'        => array( 'path' => "\n\n" ),
+            'a string with carriage returns' => array( 'path' => "\r\r" ),
+
+            // Ensure that strings with leading/trailing whitespace are invalid.
+            'a path with a leading space'    => array( 'path' => ' /path' ),
+            'a path with a trailing space'   => array( 'path' => '/path ' ),
+            'a path with a leading tab'      => array( 'path' => "\t/path" ),
+            'a path with a trailing tab'     => array( 'path' => "/path\t" ),
         );
     }
@@ -1558 +1579 @@
 
     /**
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
      * Tests that `WP_Upgrader::download_package()` returns a file with the
      * package name in it.