From 09cef5be6c9953f8c46f8390aeaef8a036820ce2 Mon Sep 17 00:00:00 2001 From: Volodymyr Kolesnykov Date: Fri, 28 Aug 2026 00:09:18 +0300 Subject: [PATCH] fix(rest-api): reject non-string secrets Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- __tests__/unit-tests/test-rest-api.php | 11 +++++++++++ includes/class-rest-api.php | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/__tests__/unit-tests/test-rest-api.php b/__tests__/unit-tests/test-rest-api.php index c8bdc262..832bc9f7 100644 --- a/__tests__/unit-tests/test-rest-api.php +++ b/__tests__/unit-tests/test-rest-api.php @@ -116,6 +116,17 @@ public function test_run_event() { $this->assertArrayHasKey( 'message', $data ); } + public function test_array_secret_is_rejected() { + $request = new WP_REST_Request( 'POST', '/' . REST_API::API_NAMESPACE . '/' . REST_API::ENDPOINT_LIST ); + $request->set_body( wp_json_encode( [ 'secret' => [] ] ) ); + $request->set_header( 'content-type', 'application/json' ); + + $response = $this->server->dispatch( $request ); + + $this->assertResponseStatus( 400, $response ); + $this->assertEquals( 'no-secret', $response->get_data()['code'] ); + } + /** * Check response code * diff --git a/includes/class-rest-api.php b/includes/class-rest-api.php index ddf53c74..85c81fbb 100644 --- a/includes/class-rest-api.php +++ b/includes/class-rest-api.php @@ -144,7 +144,7 @@ public function check_secret( $request ) { $body = $request->get_json_params(); // For now, mimic original plugin's "authentication" method. This needs to be better. - if ( ! isset( $body['secret'] ) || ! hash_equals( \WP_CRON_CONTROL_SECRET, $body['secret'] ) ) { + if ( ! isset( $body['secret'] ) || ! is_string( \WP_CRON_CONTROL_SECRET ) || ! is_string( $body['secret'] ) || ! hash_equals( \WP_CRON_CONTROL_SECRET, $body['secret'] ) ) { return new \WP_Error( 'no-secret', __( 'Secret must be specified with all requests', 'automattic-cron-control' ),