diff --git a/.distignore b/.distignore index ad443092..eb2faaf8 100644 --- a/.distignore +++ b/.distignore @@ -32,7 +32,6 @@ apigen.neon CHANGELOG.md babel.config.js -composer.json composer.lock gulpfile.js labels.json @@ -54,4 +53,4 @@ yarn-lock.json *.css.map # plugin release zip -*.zip \ No newline at end of file +*.zip diff --git a/bin/verify-release-artifact.js b/bin/verify-release-artifact.js index 350c4aaa..27b5c264 100644 --- a/bin/verify-release-artifact.js +++ b/bin/verify-release-artifact.js @@ -8,6 +8,7 @@ const { execFileSync } = require( 'child_process' ); const pluginRoot = 'content-control'; const requiredPaths = [ + 'composer.json', 'content-control.php', 'readme.txt', 'dist/settings-page.js', diff --git a/classes/Base/Stream.php b/classes/Base/Stream.php index a5d6f5ce..5a6f77f7 100644 --- a/classes/Base/Stream.php +++ b/classes/Base/Stream.php @@ -13,6 +13,13 @@ /** * HTTP Stream class. + * + * This class writes the `text/event-stream` wire format, not HTML. HTML + * escaping would corrupt SSE framing. Event names are reduced to the + * characters permitted by this implementation, non-string payloads are JSON + * encoded, and every payload line is emitted as a separate `data:` field. + * Content Control uses this only from capability- and nonce-protected + * administrative upgrade handlers. */ class Stream { @@ -36,7 +43,11 @@ class Stream { * @param string $stream_name Stream name. */ public function __construct( $stream_name = 'stream' ) { - $this->stream_name = $stream_name; + $this->stream_name = sanitize_key( $stream_name ); + + if ( empty( $this->stream_name ) ) { + $this->stream_name = 'stream'; + } } /** @@ -107,10 +118,8 @@ protected function flush_buffers() { * @return void */ public function send_data( $data ) { - $data = is_string( $data ) ? $data : \wp_json_encode( $data ); - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped - echo "data: {$data}" . PHP_EOL; + echo $this->format_data( $data ); echo PHP_EOL; $this->flush_buffers(); @@ -125,17 +134,36 @@ public function send_data( $data ) { * @return void */ public function send_event( $event, $data = '' ) { - $data = is_string( $data ) ? $data : \wp_json_encode( $data ); + $event = preg_replace( '/[^a-zA-Z0-9_.:-]/', '', (string) $event ); + $event = empty( $event ) ? 'message' : $event; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped - echo "event: {$event}" . PHP_EOL; + echo 'event: ' . $event . PHP_EOL; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped - echo "data: {$data}" . PHP_EOL; + echo $this->format_data( $data ); echo PHP_EOL; $this->flush_buffers(); } + /** + * Format a value as one or more SSE data fields. + * + * @param mixed $data Data to format. + * + * @return string + */ + protected function format_data( $data ) { + $data = is_string( $data ) ? $data : \wp_json_encode( $data ); + $data = is_string( $data ) ? $data : ''; + $data = str_replace( [ "\r\n", "\r" ], "\n", $data ); + $lines = explode( "\n", $data ); + + return implode( PHP_EOL, array_map( static function ( $line ) { + return 'data: ' . $line; + }, $lines ) ) . PHP_EOL; + } + /** * Send an error to the client. * diff --git a/classes/Controllers/Admin/Reviews.php b/classes/Controllers/Admin/Reviews.php index 2b083d7f..f9879032 100644 --- a/classes/Controllers/Admin/Reviews.php +++ b/classes/Controllers/Admin/Reviews.php @@ -90,17 +90,16 @@ public function installed_on() { * @return void */ public function ajax_handler() { - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized - if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( wp_unslash( $_REQUEST['nonce'] ), 'content_control_review_action' ) ) { + if ( ! isset( $_REQUEST['nonce'] ) || ! is_string( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ), 'content_control_review_action' ) ) { wp_send_json_error(); } - $args = wp_parse_args( $_REQUEST, [ - 'group' => $this->get_trigger_group(), - 'code' => $this->get_trigger_code(), - 'pri' => $this->get_current_trigger( 'pri' ), - 'reason' => 'maybe_later', - ] ); + $args = [ + 'group' => isset( $_REQUEST['group'] ) && is_string( $_REQUEST['group'] ) ? sanitize_key( wp_unslash( $_REQUEST['group'] ) ) : $this->get_trigger_group(), + 'code' => isset( $_REQUEST['code'] ) && is_string( $_REQUEST['code'] ) ? sanitize_key( wp_unslash( $_REQUEST['code'] ) ) : $this->get_trigger_code(), + 'pri' => isset( $_REQUEST['pri'] ) && is_numeric( $_REQUEST['pri'] ) ? absint( $_REQUEST['pri'] ) : $this->get_current_trigger( 'pri' ), + 'reason' => isset( $_REQUEST['reason'] ) && is_string( $_REQUEST['reason'] ) ? sanitize_key( wp_unslash( $_REQUEST['reason'] ) ) : 'maybe_later', + ]; try { $user_id = get_current_user_id(); @@ -484,20 +483,20 @@ function dismiss(reason) {

~ @danieliser