Repository navigation
Media: Sanitize the attachment title derived from the filename in the REST API - #13888
zakariabinsaifullah wants to merge 1 commit into
Conversation
… REST API. When a file is uploaded through `POST /wp/v2/media` without a title, the title was built from the raw uploaded filename without sanitization. Browsers send a double quote in a multipart filename as `%22`, so uploading `"css".png` from the block editor produced the title `%22css%22`, while the media library produced `css`. Run the derived title through `sanitize_text_field()`, as `media_handle_upload()` does, so both upload paths name attachments the same way. Follow-up to [58447]. See #66226, #16191. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
When a file is uploaded through
POST /wp/v2/media(the block editor path) without a title,WP_REST_Attachments_Controller::insert_attachment()builds the title from the raw uploaded filename without sanitizing it.Browsers send a double quote in a multipart filename as
%22, so uploading"css".pngfrom the block editor creates the title%22css%22. The media library path (media_handle_upload()) producescss, because it runs the name throughsanitize_text_field(). HTML in a filename is also kept as-is (<b>Bold</b> Name).This is a follow-up to r58447 (#57957). That change was meant to make REST upload titles match the media library, but it didn't apply the same sanitization.
Change
Wrap the derived title in
sanitize_text_field(), asmedia_handle_upload()does. Plain filenames are unchanged. The existingtest_rest_upload_filename_spacescases (spaces, periods, dashes) still pass.Tests
New
test_rest_upload_filename_title_is_sanitized()(@ticket 66226) covers:%22Quoted%22.jpg→Quotedquote%22in%22middle.jpg→quoteinmiddle<b>Bold</b> Name.jpg→Bold NamePlain Name.jpg→Plain NameLocal results (MariaDB, PHP 8.5):
'%22Quoted%22'instead of'Quoted').WP_Test_REST_Attachments_Controller: OK (204 tests, 2 skipped)--group media: OK (847 tests, 53 skipped; the skips depend on the environment)phpcspasses.I reproduced it manually on trunk in Chrome: a REST upload of
"css".pnggot the title%22css%22, and a media library upload gotcss.Trac ticket: https://core.trac.wordpress.org/ticket/66226
Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Reproducing the issue, tracing the cause, drafting the fix and tests, and running the test suite. I reviewed the final changes and take responsibility for them.
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.