Skip to content
This repository has been archived by the owner on Feb 23, 2024. It is now read-only.

Commit

Permalink
Replace sanitization functions to enforce string values (#10242)
Browse files Browse the repository at this point in the history
  • Loading branch information
mikejolley authored Jul 17, 2023
1 parent b8622b4 commit 0346b5a
Show file tree
Hide file tree
Showing 3 changed files with 59 additions and 11 deletions.
20 changes: 10 additions & 10 deletions src/StoreApi/Schemas/V1/AbstractAddressSchema.php
Original file line number Diff line number Diff line change
Expand Up @@ -92,16 +92,16 @@ public function sanitize_callback( $address, $request, $param ) {
$validation_util = new ValidationUtils();

$address = array_merge( array_fill_keys( array_keys( $this->get_properties() ), '' ), (array) $address );
$address['country'] = wc_strtoupper( wc_clean( wp_unslash( $address['country'] ) ) );
$address['first_name'] = wc_clean( wp_unslash( $address['first_name'] ) );
$address['last_name'] = wc_clean( wp_unslash( $address['last_name'] ) );
$address['company'] = wc_clean( wp_unslash( $address['company'] ) );
$address['address_1'] = wc_clean( wp_unslash( $address['address_1'] ) );
$address['address_2'] = wc_clean( wp_unslash( $address['address_2'] ) );
$address['city'] = wc_clean( wp_unslash( $address['city'] ) );
$address['state'] = $validation_util->format_state( wc_clean( wp_unslash( $address['state'] ) ), $address['country'] );
$address['postcode'] = $address['postcode'] ? wc_format_postcode( wc_clean( wp_unslash( $address['postcode'] ) ), $address['country'] ) : '';
$address['phone'] = wc_clean( wp_unslash( $address['phone'] ) );
$address['country'] = wc_strtoupper( sanitize_text_field( wp_unslash( $address['country'] ) ) );
$address['first_name'] = sanitize_text_field( wp_unslash( $address['first_name'] ) );
$address['last_name'] = sanitize_text_field( wp_unslash( $address['last_name'] ) );
$address['company'] = sanitize_text_field( wp_unslash( $address['company'] ) );
$address['address_1'] = sanitize_text_field( wp_unslash( $address['address_1'] ) );
$address['address_2'] = sanitize_text_field( wp_unslash( $address['address_2'] ) );
$address['city'] = sanitize_text_field( wp_unslash( $address['city'] ) );
$address['state'] = $validation_util->format_state( sanitize_text_field( wp_unslash( $address['state'] ) ), $address['country'] );
$address['postcode'] = $address['postcode'] ? wc_format_postcode( sanitize_text_field( wp_unslash( $address['postcode'] ) ), $address['country'] ) : '';
$address['phone'] = sanitize_text_field( wp_unslash( $address['phone'] ) );
return $address;
}

Expand Down
2 changes: 1 addition & 1 deletion src/StoreApi/Schemas/V1/BillingAddressSchema.php
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ public function get_properties() {
*/
public function sanitize_callback( $address, $request, $param ) {
$address = parent::sanitize_callback( $address, $request, $param );
$address['email'] = wc_clean( wp_unslash( $address['email'] ) );
$address['email'] = sanitize_text_field( wp_unslash( $address['email'] ) );
return $address;
}

Expand Down
48 changes: 48 additions & 0 deletions tests/php/StoreApi/Routes/Checkout.php
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@

/**
* Checkout Controller Tests.
*
* phpcs:disable WordPress.PHP.DevelopmentFunctions.error_log_print_r, WooCommerce.Commenting.CommentHooks.MissingHookComment
*/
class Checkout extends MockeryTestCase {
/**
Expand Down Expand Up @@ -385,4 +387,50 @@ public function test_checkout_force_create_account() {
$customer = get_user_by( 'id', $data['customer_id'] );
$this->assertEquals( $customer->user_email, '[email protected]' );
}

/**
* Test account creation options.
*/
public function test_checkout_invalid_address_data() {
$request = new \WP_REST_Request( 'POST', '/wc/store/v1/checkout' );
$request->set_header( 'Nonce', wp_create_nonce( 'wc_store_api' ) );
$request->set_body_params(
array(
'billing_address' => (object) array(
'first_name' => 'test',
'last_name' => array(
'invalid' => 'invalid_data',
),
'company' => '',
'address_1' => 'test',
'address_2' => '',
'city' => 'test',
'state' => '',
'postcode' => 'cb241ab',
'country' => 'GB',
'phone' => '',
'email' => '[email protected]',
),
'shipping_address' => (object) array(
'first_name' => 'test',
'last_name' => 'test',
'company' => '',
'address_1' => 'test',
'address_2' => '',
'city' => 'test',
'state' => '',
'postcode' => 'cb241ab',
'country' => 'GB',
'phone' => '',
),
'payment_method' => 'bacs',
)
);

$response = rest_get_server()->dispatch( $request );
$status = $response->get_status();
$data = $response->get_data();

$this->assertEquals( 400, $status, print_r( $data, true ) );
}
}

0 comments on commit 0346b5a

Please sign in to comment.