[Security] Insufficient Input Sanitization in REST API

[pbking]

Security Issue: Insufficient Input Sanitization in REST API

Description

User input from REST API requests is not consistently sanitized before database operations, which could lead to potential XSS or SQL injection vulnerabilities.

Affected Files

• class-pattern-builder-api.php:388-459

Risk Level

Critical - Unsanitized user input could lead to stored XSS attacks or data corruption.

Current Issues

• Title fields are not sanitized with sanitize_text_field()
• HTML content lacks proper sanitization with wp_kses_post()
• Array inputs are not sanitized with array_map() and appropriate sanitization functions

Recommendations

1. Add sanitize_text_field() for all title and text-only fields
2. Use wp_kses_post() for content fields that allow HTML
3. Sanitize array inputs using array_map() with appropriate sanitization callbacks
4. Validate data types before processing (strings, arrays, integers)

Implementation Steps

• Audit all REST API endpoints for input handling
• Add sanitization layer to all user inputs before database operations
• Implement input validation for expected data types
• Add unit tests for input sanitization
• Document expected input formats in API documentation

Code Example

// Before
$title = $request->get_param('title');

// After
$title = sanitize_text_field($request->get_param('title'));

References

• WordPress Data Validation
• WordPress REST API Security

Priority: Immediate fix required

[pbking]

Issue Review and Resolution

I've reviewed this security issue and confirmed that all the input sanitization issues mentioned were still present in the codebase. The security vulnerabilities have now been fully addressed in PR #33.

Issues Found and Fixed ✅

1. Title Fields Not Sanitized

• Problem: $pattern->title = $updated_pattern['title'] used raw input
• Fixed: Now using sanitize_text_field() for all title inputs

2. HTML Content Not Properly Sanitized

• Problem: $pattern->content = $updated_pattern['content'] allowed unsanitized HTML
• Fixed: Now using wp_kses_post() to allow safe HTML while preventing XSS

3. Array Inputs Not Sanitized

• Problem: Block types, post types, and template types arrays used raw values
• Fixed: Now using array_map('sanitize_text_field') for all array inputs

4. Query Parameters Unsanitized

• Problem: $request->get_param() values used directly
• Fixed: All query parameters now sanitized with sanitize_text_field()

Additional Security Improvements 🛡️

Beyond the original requirements, I also added:

• JSON Validation: Added json_last_error() checks to prevent malformed JSON attacks
• Enum Validation: Restricted fields like source, sync_status to expected values only
• Centralized Sanitization: Created sanitize_pattern_input() method for consistent handling
• Type Validation: Added proper data type validation for all inputs

Code Example

Before (Vulnerable):

$updated_pattern = json_decode($request->get_body(), true);
$pattern->title = $updated_pattern['title']; // ❌ XSS vulnerable
$pattern->content = $updated_pattern['content']; // ❌ XSS vulnerable

After (Secure):

$updated_pattern = json_decode($request->get_body(), true);
$updated_pattern = $this->sanitize_pattern_input($updated_pattern);
$pattern->title = $updated_pattern['title']; // ✅ Sanitized
$pattern->content = $updated_pattern['content']; // ✅ wp_kses_post() filtered

Testing Confirmed ✅

• Title injection attempts blocked
• Script tags in content properly filtered
• Array values individually sanitized
• Malformed JSON handled gracefully
• All functionality preserved

Resolution: All input sanitization issues have been comprehensively addressed. This critical security vulnerability is now fully patched in PR #33.

The API now properly sanitizes all user input while maintaining full functionality.