Skip to content
This repository has been archived by the owner on Feb 23, 2024. It is now read-only.

Replace sanitization functions to enforce string values #10242

Merged
merged 1 commit into from
Jul 17, 2023
Merged

Replace sanitization functions to enforce string values #10242

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions src/StoreApi/Schemas/V1/AbstractAddressSchema.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,16 +92,16 @@ public function sanitize_callback( $address, $request, $param ) {
$validation_util = new ValidationUtils();

$address = array_merge( array_fill_keys( array_keys( $this->get_properties() ), '' ), (array) $address );
$address['country'] = wc_strtoupper( wc_clean( wp_unslash( $address['country'] ) ) );
$address['first_name'] = wc_clean( wp_unslash( $address['first_name'] ) );
$address['last_name'] = wc_clean( wp_unslash( $address['last_name'] ) );
$address['company'] = wc_clean( wp_unslash( $address['company'] ) );
$address['address_1'] = wc_clean( wp_unslash( $address['address_1'] ) );
$address['address_2'] = wc_clean( wp_unslash( $address['address_2'] ) );
$address['city'] = wc_clean( wp_unslash( $address['city'] ) );
$address['state'] = $validation_util->format_state( wc_clean( wp_unslash( $address['state'] ) ), $address['country'] );
$address['postcode'] = $address['postcode'] ? wc_format_postcode( wc_clean( wp_unslash( $address['postcode'] ) ), $address['country'] ) : '';
$address['phone'] = wc_clean( wp_unslash( $address['phone'] ) );
$address['country'] = wc_strtoupper( sanitize_text_field( wp_unslash( $address['country'] ) ) );
$address['first_name'] = sanitize_text_field( wp_unslash( $address['first_name'] ) );
$address['last_name'] = sanitize_text_field( wp_unslash( $address['last_name'] ) );
$address['company'] = sanitize_text_field( wp_unslash( $address['company'] ) );
$address['address_1'] = sanitize_text_field( wp_unslash( $address['address_1'] ) );
$address['address_2'] = sanitize_text_field( wp_unslash( $address['address_2'] ) );
$address['city'] = sanitize_text_field( wp_unslash( $address['city'] ) );
$address['state'] = $validation_util->format_state( sanitize_text_field( wp_unslash( $address['state'] ) ), $address['country'] );
$address['postcode'] = $address['postcode'] ? wc_format_postcode( sanitize_text_field( wp_unslash( $address['postcode'] ) ), $address['country'] ) : '';
$address['phone'] = sanitize_text_field( wp_unslash( $address['phone'] ) );
return $address;
}

Expand Down
2 changes: 1 addition & 1 deletion src/StoreApi/Schemas/V1/BillingAddressSchema.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ public function get_properties() {
*/
public function sanitize_callback( $address, $request, $param ) {
$address = parent::sanitize_callback( $address, $request, $param );
$address['email'] = wc_clean( wp_unslash( $address['email'] ) );
$address['email'] = sanitize_text_field( wp_unslash( $address['email'] ) );
return $address;
}

Expand Down
48 changes: 48 additions & 0 deletions tests/php/StoreApi/Routes/Checkout.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@

/**
* Checkout Controller Tests.
*
* phpcs:disable WordPress.PHP.DevelopmentFunctions.error_log_print_r, WooCommerce.Commenting.CommentHooks.MissingHookComment
*/
class Checkout extends MockeryTestCase {
/**
Expand Down Expand Up @@ -385,4 +387,50 @@ public function test_checkout_force_create_account() {
$customer = get_user_by( 'id', $data['customer_id'] );
$this->assertEquals( $customer->user_email, '[email protected]' );
}

/**
* Test account creation options.
*/
public function test_checkout_invalid_address_data() {
$request = new \WP_REST_Request( 'POST', '/wc/store/v1/checkout' );
$request->set_header( 'Nonce', wp_create_nonce( 'wc_store_api' ) );
$request->set_body_params(
array(
'billing_address' => (object) array(
'first_name' => 'test',
'last_name' => array(
'invalid' => 'invalid_data',
),
'company' => '',
'address_1' => 'test',
'address_2' => '',
'city' => 'test',
'state' => '',
'postcode' => 'cb241ab',
'country' => 'GB',
'phone' => '',
'email' => '[email protected]',
),
'shipping_address' => (object) array(
'first_name' => 'test',
'last_name' => 'test',
'company' => '',
'address_1' => 'test',
'address_2' => '',
'city' => 'test',
'state' => '',
'postcode' => 'cb241ab',
'country' => 'GB',
'phone' => '',
),
'payment_method' => 'bacs',
)
);

$response = rest_get_server()->dispatch( $request );
$status = $response->get_status();
$data = $response->get_data();

$this->assertEquals( 400, $status, print_r( $data, true ) );
}
}