fix(rest-api): reject non-string secrets

[sjinks]

Reject non-string configured and request secrets before hash_equals, returning the existing no-secret response. Adds array-secret REST coverage. PHP syntax, PHPCS, and git diff --check pass locally; PHPUnit requires the unavailable local WordPress/MariaDB harness. Fixes PLTFRM-2762.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

Updates the Cron Control REST API authentication check to safely reject non-string secrets before calling hash_equals(), preventing type-related errors and ensuring a consistent error response. Adds a unit test covering an array-valued secret in REST requests.

Changes:

• Reject non-string configured secrets and non-string request secrets before hash_equals() in REST permission checks.
• Add unit test verifying an array secret is rejected with the existing no-secret error.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
includes/class-rest-api.php	Adds is_string() guards before hash_equals() in check_secret() to reject non-string secrets safely.
tests/unit-tests/test-rest-api.php	Adds unit test ensuring an array secret yields the expected 400 no-secret response.

Suppressed comments (1)

includes/class-rest-api.php:151

• The new validation rejects non-string secrets, but the returned message still implies the secret is merely missing. Updating the message to mention the expected type will make client-side debugging clearer while keeping the same error code.

		if ( ! isset( $body['secret'] ) || ! is_string( \WP_CRON_CONTROL_SECRET ) || ! is_string( $body['secret'] ) || ! hash_equals( \WP_CRON_CONTROL_SECRET, $body['secret'] ) ) {
			return new \WP_Error(
				'no-secret',
				__( 'Secret must be specified with all requests', 'automattic-cron-control' ),
				array(

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.