Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Editor: Sanitize nested array in theme.json properly. 

WP_Theme_JSON sanitization is now able to sanitize data contained on indexed arrays. 
So certain data from theme.json, for example, settings.typography.fontFamilies which is a JSON array will be sanitized.

Props mmaattiiaass, mukesh27.
Fixes #60360.
Built from https://develop.svn.wordpress.org/trunk@57496


git-svn-id: http://core.svn.wordpress.org/trunk@56997 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
youknowriad 2024-01-31 10:55:10 +00:00
parent 4a56947b5b
commit e28108b73e
2 changed files with 127 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

138
wp-includes/class-wp-theme-json.php
View File

@ -429,6 +429,38 @@ class WP_Theme_JSON {
),
);
/*
* The valid properties for fontFamilies under settings key.
*
* @since 6.5.0
*
* @var array
*/
const FONT_FAMILY_SCHEMA = array(
array(
'fontFamily' => null,
'name' => null,
'slug' => null,
'fontFace' => array(
array(
'ascentOverride' => null,
'descentOverride' => null,
'fontDisplay' => null,
'fontFamily' => null,
'fontFeatureSettings' => null,
'fontStyle' => null,
'fontStretch' => null,
'fontVariationSettings' => null,
'fontWeight' => null,
'lineGapOverride' => null,
'sizeAdjust' => null,
'src' => null,
'unicodeRange' => null,
),
),
),
);
/**
* The valid properties under the styles key.
*
@ -556,6 +588,52 @@ class WP_Theme_JSON {
'typography' => 'typography',
);
/**
* Return the input schema at the root and per origin.
*
* @since 6.5.0
*
* @param array $schema The base schema.
* @return array The schema at the root and per origin.
*
* Example:
* schema_in_root_and_per_origin(
* array(
* 'fontFamily' => null,
* 'slug' => null,
* )
* )
*
* Returns:
* array(
* 'fontFamily' => null,
* 'slug' => null,
* 'default' => array(
* 'fontFamily' => null,
* 'slug' => null,
* ),
* 'blocks' => array(
* 'fontFamily' => null,
* 'slug' => null,
* ),
* 'theme' => array(
* 'fontFamily' => null,
* 'slug' => null,
* ),
* 'custom' => array(
* 'fontFamily' => null,
* 'slug' => null,
* ),
* )
*/
protected static function schema_in_root_and_per_origin( $schema ) {
$schema_in_root_and_per_origin = $schema;
foreach ( static::VALID_ORIGINS as $origin ) {
$schema_in_root_and_per_origin[ $origin ] = $schema;
}
return $schema_in_root_and_per_origin;
}
/**
* Returns a class name by an element name.
*
@ -797,11 +875,12 @@ class WP_Theme_JSON {
$schema_styles_blocks[ $block ]['variations'] = $schema_styles_variations;
}
$schema['styles'] = static::VALID_STYLES;
$schema['styles']['blocks'] = $schema_styles_blocks;
$schema['styles']['elements'] = $schema_styles_elements;
$schema['settings'] = static::VALID_SETTINGS;
$schema['settings']['blocks'] = $schema_settings_blocks;
$schema['styles'] = static::VALID_STYLES;
$schema['styles']['blocks'] = $schema_styles_blocks;
$schema['styles']['elements'] = $schema_styles_elements;
$schema['settings'] = static::VALID_SETTINGS;
$schema['settings']['blocks'] = $schema_settings_blocks;
$schema['settings']['typography']['fontFamilies'] = static::schema_in_root_and_per_origin( static::FONT_FAMILY_SCHEMA );
// Remove anything that's not present in the schema.
foreach ( array( 'styles', 'settings' ) as $subtree ) {
@ -974,18 +1053,39 @@ class WP_Theme_JSON {
* @return array The modified $tree.
*/
protected static function remove_keys_not_in_schema( $tree, $schema ) {
$tree = array_intersect_key( $tree, $schema );
if ( ! is_array( $tree ) ) {
return $tree;
}
foreach ( $schema as $key => $data ) {
if ( ! isset( $tree[ $key ] ) ) {
foreach ( $tree as $key => $value ) {
// Remove keys not in the schema or with null/empty values.
if ( ! array_key_exists( $key, $schema ) ) {
unset( $tree[ $key ] );
continue;
}
if ( is_array( $schema[ $key ] ) && is_array( $tree[ $key ] ) ) {
$tree[ $key ] = static::remove_keys_not_in_schema( $tree[ $key ], $schema[ $key ] );
// Check if the value is an array and requires further processing.
if ( is_array( $value ) && is_array( $schema[ $key ] ) ) {
// Determine if it is an associative or indexed array.
$schema_is_assoc = self::is_assoc( $value );
if ( empty( $tree[ $key ] ) ) {
unset( $tree[ $key ] );
if ( $schema_is_assoc ) {
// If associative, process as a single object.
$tree[ $key ] = self::remove_keys_not_in_schema( $value, $schema[ $key ] );
if ( empty( $tree[ $key ] ) ) {
unset( $tree[ $key ] );
}
} else {
// If indexed, process each item in the array.
foreach ( $value as $item_key => $item_value ) {
if ( isset( $schema[ $key ][0] ) && is_array( $schema[ $key ][0] ) ) {
$tree[ $key ][ $item_key ] = self::remove_keys_not_in_schema( $item_value, $schema[ $key ][0] );
} else {
// If the schema does not define a further structure, keep the value as is.
$tree[ $key ][ $item_key ] = $item_value;
}
}
}
} elseif ( is_array( $schema[ $key ] ) && ! is_array( $tree[ $key ] ) ) {
unset( $tree[ $key ] );
@ -995,6 +1095,20 @@ class WP_Theme_JSON {
return $tree;
}
/**
* Checks if the given array is associative.
*
* @since 6.5.0
* @param array $data The array to check.
* @return bool True if the array is associative, false otherwise.
*/
protected static function is_assoc( $data ) {
if ( array() === $data ) {
return false;
}
return array_keys( $data ) !== range( 0, count( $data ) - 1 );
}
/**
* Returns the existing settings for each block.
*

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '6.5-alpha-57495';
$wp_version = '6.5-alpha-57496';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.