Update the API client to validate route params before making a request #9030
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Test the buildOption 1. Jetpack Beta
Option 2. Jurassic Ninja - available for logged-in A12s🚀 Launch a JN site with this branch 🚀 ℹ️ Install this Tampermonkey script to get more options. Build info:
Note: the build is updated when a new commit is pushed to this PR. |
|
Size Change: 0 B Total Size: 1.26 MB ℹ️ View Unchanged
|
dmvrtx
requested changes
Jun 28, 2024
includes/admin/class-wc-rest-payments-authorizations-controller.php
Outdated
Show resolved
Hide resolved
…/woocommerce-payments into update/route-regex-validation
This reverts commit 5481ff0.
…/woocommerce-payments into update/route-regex-validation
deepakpathania
changed the title
dmvrtx
approved these changes
Jun 28, 2024
I considered it but then thought different methods could also check for other conditions related to that param maybe and having it in the method itself might be more flexible, don't have a strong usecase for this at the top of my head except for length check in some cases like |
marcinbot
reviewed
Jun 28, 2024
shendy-a8c
reviewed
Jul 4, 2024
There was a problem hiding this comment.
Tested challenging dispute and it worked.
However, I check all the request() calls in wc-payment-api/class-wc-payments-api-client.php and found $customer_id is not validated here.
$product_id is not validated as well here.
There are more cases like that where parameter that is passed as part of the request URL, is not validated.
Are those out of this PR's scope?
|
@shendy-a8c Wherever there was an existing validation for the param being passed, we didn't update that to defer to the existing checks. Update: Added validation for missing places as well. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes https://github.com/Automattic/woocommerce-payments-server/issues/1548
Changes proposed in this Pull Request
Testing instructions
npm run changelogto add a changelog file, choosepatchto leave it empty if the change is not significant. You can add multiple changelog files in one PR by running this command a few times.Post merge