Themes API: Validate actions and protocol input, document trusted output paths by obenland · Pull Request #801 · WordPress/wordpress.org

obenland · 2026-08-13T01:06:16Z

Part of a sweep resolving all WordPress.Security PHPCS findings on the unauthenticated api.wordpress.org endpoints.

API actions are validated against their expected [a-z_] format across 1.0 and 1.2.
SERVER_PROTOCOL is format-validated before being echoed into status headers.
JSONP callbacks are sanitized at the source in 1.1.
The serialized/JSON response paths carry narrow justified ignores (escaping would corrupt the payloads), and parsing the request before WordPress loads is documented via justified file-level unslash/nonce disables.

All files report zero WordPress.Security violations.

🤖 Generated with Claude Code

github-actions · 2026-08-13T01:06:25Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Copilot

Pull request overview

This PR hardens the unauthenticated Themes API endpoints by validating user-controlled inputs (actions, protocol strings, JSONP callback) and adding narrowly scoped PHPCS ignores where escaping/sanitizing would corrupt serialized/JSON payloads or where WordPress isn’t loaded yet.

Changes:

Adds stricter validation for SERVER_PROTOCOL and action parameters in the Themes Info endpoints (1.0/1.2).
Documents and justifies output-not-escaped paths for JSON/serialized responses and pre-WordPress request parsing.
Sanitizes CORS origin and JSONP callback handling paths, adding targeted PHPCS ignores.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
api.wordpress.org/public_html/themes/theme-directory/1.0/index.php	Sanitizes Origin/JSONP callback output and refactors action/nonce/theme input handling for authenticated theme-favorite actions.
api.wordpress.org/public_html/themes/info/1.2/index.php	Adds file-level PHPCS rationale and validates protocol/action when normalizing “flat” GET requests before delegating to 1.1.
api.wordpress.org/public_html/themes/info/1.1/index.php	Adds file-level PHPCS rationale, refines JSONP callback sanitization, and documents trusted output of 1.0 payload.
api.wordpress.org/public_html/themes/info/1.0/index.php	Documents pre-WordPress request parsing, validates `SERVER_PROTOCOL` and `action`, and adds justified output/unsanitized-input ignores for serialized/JSON payloads.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

…put paths. API actions are validated against their expected format, the server protocol is validated before being echoed into status headers, and JSONP callbacks are sanitized at the source. The serialized/JSON response paths carry narrow, justified ignores since escaping would corrupt the payloads, and request parsing before WordPress loads is documented via justified file-level unslash/nonce disables. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit 5c8b73f740980cc1047bcbba93c09ec636feff3a)

JSONP callbacks that are not valid JavaScript identifiers (e.g. starting with a digit) now fall back to plain JSON instead of emitting invalid script. The theme-directory action and theme parameters are validated against their expected formats and rejected when malformed, rather than sanitize_key() silently transforming a malformed value into a valid one — which had made `add-favorite@@` executable where trunk rejected it. The 1.2 endpoint now rejects every non-GET/HEAD method, not just POST. Inline ignores are restored to single-line form, since an annotation inside a multi-line block comment does not apply to the code following the comment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ocks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Replaces the strip-then-check-first-character dance with one identifier validation; a callback that isn't a valid JavaScript identifier falls back to plain JSON instead of being partially salvaged into a different (wrong) function name. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…s justification. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ites. An invalid or array `theme` parameter was coerced to an empty string or false by the validation fallback and still written to the user's favorites meta with a success response; it now returns bad_request. The slug pattern also allows underscores, which sanitize_title_with_dashes() preserves and the themes info endpoint already accepts. The 1.2 method guard no longer rejects OPTIONS — trunk served preflights — and the Allow header lists the permitted methods. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

PCRE's $ end-anchor matches before a trailing newline, letting values like "twentytwenty\n" pass slug and protocol validation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

coderabbitai · 2026-10-16T21:54:26Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 1504d4f3-809c-42b7-9ed1-b905f5906b52

📥 Commits

Reviewing files that changed from the base of the PR and between 1afad22 and 010c917.

📒 Files selected for processing: 4

api.wordpress.org/public_html/themes/info/1.0/index.php
api.wordpress.org/public_html/themes/info/1.1/index.php
api.wordpress.org/public_html/themes/info/1.2/index.php
api.wordpress.org/public_html/themes/theme-directory/1.0/index.php

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

obenland · 2026-10-21T22:03:43Z

@coderabbitai help

coderabbitai · 2026-10-21T22:03:51Z

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

CodeRabbit commands

These commands are invoked using PR/Issue comments.

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai review --preview-config to test the unmerged CodeRabbit configuration on a draft PR. The requester must have repository write access; preview results are non-authoritative.
@coderabbitai rate limit to show your current review rate limit status.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai track in a human-authored review thread to track the original finding until CodeRabbit verifies it is fixed.
@coderabbitai fixed in a tracked review thread to verify the current code against the original finding.
@coderabbitai evaluate custom pre-merge check --instructions <custom-checks-instructions> --name <custom-checks-title> [--mode <error|warning>] to validate the custom pre-merge checks instructions. Defaults to error when --mode is omitted.
@coderabbitai ignore pre-merge checks to override pre-merge checks and get an approval on PR.
@coderabbitai run pre-merge checks to run pre-merge checks on the pull request.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai emit path instructions to emit generated path-specific review instructions for this repository.
@coderabbitai generate project vocabulary to list vocabulary that is specific to this repository (requires an Essentials plan or above with an active subscription).
@coderabbitai resolve merge conflict to automatically resolve merge conflicts.
@coderabbitai fix comments to automatically fix issues in the current review thread, or all unresolved review comments when used in the PR conversation.
@coderabbitai autofix (alias: @coderabbitai autopilot) to enable Autofix to fix CodeRabbit findings and required CI, and resolve merge conflicts.
@coderabbitai autofix resume to resume Autofix for this PR.
@coderabbitai autofix stop to stop Autofix for this PR.
@coderabbitai fix-ci to automatically fix failing CI checks in a stacked pull request.
@coderabbitai fix-ci commit to automatically fix failing CI checks by committing fixes to the current branch.
@coderabbitai resolve to resolve all the CodeRabbit review comments.
@coderabbitai approve as a new top-level PR comment to resolve CodeRabbit review threads; also requests approval when reviews.request_changes_workflow is enabled.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai generate configuration to create a PR that adds the current resolved configuration as .coderabbit.yaml (or show it if already present).
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit configuration file (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
You can also validate your configuration using the online YAML validator.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, support, documentation and community

Visit our status page to check the current availability of CodeRabbit.
Create a ticket on our support page for assistance with any issues or questions.
Visit our documentation site for detailed information on how to use CodeRabbit.
Join our Discord community to connect with other users and get help from the community.
Follow us on X/Twitter for updates and announcements.

Copilot AI lite review requested due to automatic review settings August 13, 2026 01:06

Copilot started reviewing on behalf of obenland August 13, 2026 01:06

View session

Copilot AI reviewed Aug 13, 2026

View reviewed changes

obenland force-pushed the api/security-themes branch 4 times, most recently from 04e75ba to fe7ccd6 Compare August 13, 2026 01:28

obenland requested a lite review from Copilot August 13, 2026 01:43

Copilot AI reviewed Aug 13, 2026

obenland and others added 8 commits October 16, 2026 16:53

Themes API: Fold the phpcs justification comments into the file docbl…

3d566b8

…ocks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Themes API: Add a file docblock to the 1.0 endpoint carrying the phpc…

ac7fc04

…s justification. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Themes API: Compact the bad_request response to one line.

725b60a

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Themes API: Anchor validation regexes with \z.

010c917

PCRE's $ end-anchor matches before a trailing newline, letting values like "twentytwenty\n" pass slug and protocol validation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

obenland force-pushed the api/security-themes branch from 6f2ae8e to 010c917 Compare October 16, 2026 21:54

Navigation Menu

Repository navigation

Themes API: Validate actions and protocol input, document trusted output paths - #801

Themes API: Validate actions and protocol input, document trusted output paths#801
obenland wants to merge 8 commits into
WordPress:trunkfrom
obenland:api/security-themes

obenland commented Aug 13, 2026

Uh oh!

github-actions Bot commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Oct 16, 2026

Review limit reached

Uh oh!

obenland commented Oct 21, 2026

Uh oh!

coderabbitai Bot commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

obenland commented Aug 13, 2026

Uh oh!

github-actions Bot commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Oct 16, 2026

Review limit reached

Uh oh!

obenland commented Oct 21, 2026

Uh oh!

coderabbitai Bot commented Oct 21, 2026

Chat

CodeRabbit commands

Other keywords and placeholders

CodeRabbit configuration file (.coderabbit.yaml)

Status, support, documentation and community

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

CodeRabbit configuration file (`.coderabbit.yaml`)