Improve validation and permission checks for WP_HTTP_Polling_Sync_Server by chriszarate · Pull Request #11296 · WordPress/wordpress-develop

chriszarate · 2026-03-19T00:53:38Z

Harden WP_HTTP_Polling_Sync_Server endpoints to add additional validation and permission checks.

Props @peterwilsoncc for contributions

Trac ticket: https://core.trac.wordpress.org/ticket/64890

github-actions · 2026-03-19T00:53:47Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props czarate, westonruter, peterwilsoncc.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-03-19T00:58:23Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

westonruter · 2026-03-26T18:28:51Z

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

+
 		// Handle single post type entities with a defined object ID.
 		if ( 'postType' === $entity_kind && is_numeric( $object_id ) ) {
+			if ( get_post_type( $object_id ) !== $entity_name ) {


I noticed a type issue here:

I've added 7fd0372 to improve this. With this change, $object_id is guaranteed to be int<1, max>|null.

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

Copilot

Pull request overview

Hardens the WP_HTTP_Polling_Sync_Server REST endpoint (/wp-sync/v1/updates) by tightening request validation limits and strengthening permission checks to better protect collaboration sync operations.

Changes:

Add route-level request body size validation plus schema constraints (maxItems for rooms, maxLength for update data).
Harden entity permission checks for object-scoped rooms (post type matching, term/comment checks).
Add PHPUnit coverage for new schema/route validation behavior (type/enum/required fields, maxItems/maxLength, oversized body).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
`tests/phpunit/tests/rest-api/rest-sync-server.php`	Adds REST validation tests for schema enforcement and oversized body rejection.
`src/wp-includes/collaboration/class-wp-http-polling-sync-server.php`	Introduces new size/limit constants, route-level validation callback, and tighter per-entity permission checks.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-26T18:40:26Z

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

+	/**
+	 * Maximum size (in bytes) of a single update data string.
+	 *
+	 * @since 7.0.0
+	 * @var int
+	 */
+	const MAX_UPDATE_DATA_SIZE = MB_IN_BYTES;


MAX_UPDATE_DATA_SIZE is documented as a size "in bytes", but it's currently enforced via the REST schema's maxLength (character count). If this is intended to limit the encoded string length, consider updating the docblock wording to avoid implying decoded byte size enforcement.

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

…asting

Add targeted REST tests for permission checks in can_user_sync_entity_type() that previously lacked coverage: - Malformed object ID (non-numeric string like "1abc") rejected - Zero object ID rejected - Post type mismatch (e.g. postType/page for a post) rejected - Valid taxonomy term sync allowed - Non-existent taxonomy term rejected - Taxonomy term in wrong taxonomy rejected - Valid comment sync allowed - Non-existent comment rejected - Non-existent post type collection rejected

peterwilsoncc · 2026-03-30T01:08:42Z

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

-					'required' => true,
+					'type'      => 'string',
+					'required'  => true,
+					'maxLength' => self::MAX_UPDATE_DATA_SIZE,


@dd32 noted in slack that large content updates can be made via the code editor. Is there a way that can be handled, even if it's just to replace the content with the code edited version if it's too large.

The code editor targets post_content which is represented as a Y.Text data type in the Yjs document. Updates to this field are diffed and only the delta is transmitted as an update. It should not approach the MAX_UPDATE_DATA_SIZE except in extreme edge cases (e.g., instantly replacing a 1+ MB document with a completely different 1+ MB document).

You can follow the diffing logic here:
https://github.com/WordPress/gutenberg/blob/ccc474379718969f48c3ab0153b43d1e26b4ef51/packages/core-data/src/utils/crdt-blocks.ts#L645

github-actions · 2026-04-02T01:24:13Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 62198
GitHub commit: 2183f23

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

…g_Sync_Server Backport of WordPress/wordpress-develop#11296. Hardens WP_HTTP_Polling_Sync_Server endpoints with additional validation and permission checks: - Add MAX_BODY_SIZE, MAX_ROOMS_PER_REQUEST, MAX_UPDATE_DATA_SIZE constants - Add maxLength constraint for update data strings - Add maxItems constraint for rooms per request - Add route-level validate_callback for request body size - Improve can_user_sync_entity_type() to use ctype_digit() for object ID validation, verify post type matches, validate taxonomy terms exist in the correct taxonomy, and reject zero/negative object IDs - Add comprehensive test coverage for new validation and permission checks Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ng_Sync_Server` (#76987) * Backport: Improve validation and permission checks for WP_HTTP_Polling_Sync_Server Backport of WordPress/wordpress-develop#11296. Hardens WP_HTTP_Polling_Sync_Server endpoints with additional validation and permission checks: - Add MAX_BODY_SIZE, MAX_ROOMS_PER_REQUEST, MAX_UPDATE_DATA_SIZE constants - Add maxLength constraint for update data strings - Add maxItems constraint for rooms per request - Add route-level validate_callback for request body size - Improve can_user_sync_entity_type() to use ctype_digit() for object ID validation, verify post type matches, validate taxonomy terms exist in the correct taxonomy, and reject zero/negative object IDs - Add comprehensive test coverage for new validation and permission checks * Add backport changelog --------- Co-authored-by: chriszarate <czarate@git.wordpress.org> Co-authored-by: peterwilsoncc <peterwilsoncc@git.wordpress.org>

…ng_Sync_Server` (#76987) * Backport: Improve validation and permission checks for WP_HTTP_Polling_Sync_Server Backport of WordPress/wordpress-develop#11296. Hardens WP_HTTP_Polling_Sync_Server endpoints with additional validation and permission checks: - Add MAX_BODY_SIZE, MAX_ROOMS_PER_REQUEST, MAX_UPDATE_DATA_SIZE constants - Add maxLength constraint for update data strings - Add maxItems constraint for rooms per request - Add route-level validate_callback for request body size - Improve can_user_sync_entity_type() to use ctype_digit() for object ID validation, verify post type matches, validate taxonomy terms exist in the correct taxonomy, and reject zero/negative object IDs - Add comprehensive test coverage for new validation and permission checks * Add backport changelog --------- Co-authored-by: chriszarate <czarate@git.wordpress.org> Co-authored-by: peterwilsoncc <peterwilsoncc@git.wordpress.org> Source: WordPress/gutenberg@1be2ef2

…ng_Sync_Server` (#76987) * Backport: Improve validation and permission checks for WP_HTTP_Polling_Sync_Server Backport of WordPress/wordpress-develop#11296. Hardens WP_HTTP_Polling_Sync_Server endpoints with additional validation and permission checks: - Add MAX_BODY_SIZE, MAX_ROOMS_PER_REQUEST, MAX_UPDATE_DATA_SIZE constants - Add maxLength constraint for update data strings - Add maxItems constraint for rooms per request - Add route-level validate_callback for request body size - Improve can_user_sync_entity_type() to use ctype_digit() for object ID validation, verify post type matches, validate taxonomy terms exist in the correct taxonomy, and reject zero/negative object IDs - Add comprehensive test coverage for new validation and permission checks * Add backport changelog --------- Co-authored-by: chriszarate <czarate@git.wordpress.org> Co-authored-by: peterwilsoncc <peterwilsoncc@git.wordpress.org> Source: WordPress/gutenberg@cd91928

westonruter reviewed Mar 19, 2026

View reviewed changes

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php Show resolved Hide resolved

chriszarate force-pushed the fix/http-polling-sync-server-validation branch 2 times, most recently from 8d50677 to 5c5e67b Compare March 25, 2026 14:29

chriszarate requested a review from westonruter March 25, 2026 14:29

westonruter reviewed Mar 26, 2026

View reviewed changes

src/wp-includes/collaboration/class-wp-http-polling-sync-server.php Outdated Show resolved Hide resolved

westonruter requested a review from Copilot March 26, 2026 18:36

Copilot started reviewing on behalf of westonruter March 26, 2026 18:36 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

chriszarate and others added 6 commits March 27, 2026 18:26

Improve validation and permission checks for WP_HTTP_Polling_Sync_Server

74d3090

Add tests

842e056

Add ticket references to tests and add void return type

5281152

Ensure object ID is an integer or not null

628a2ed

Factor out common is_int() check

546d5f2

Use ctype_digit() to ensure object ID is an integer string prior to c…

9dd286b

…asting

chriszarate force-pushed the fix/http-polling-sync-server-validation branch from ebab9ea to 9dd286b Compare March 28, 2026 00:26

chriszarate and others added 4 commits March 27, 2026 18:39

Update in response to feedback

dd187cb

Add types for protected member vars

62d058f

Add void return types

532aec1

westonruter approved these changes Mar 28, 2026

View reviewed changes

peterwilsoncc reviewed Mar 30, 2026

View reviewed changes

Merge branch 'trunk' into fix/http-polling-sync-server-validation

fc8eb60

peterwilsoncc approved these changes Apr 2, 2026

View reviewed changes

github-actions bot closed this Apr 2, 2026

chriszarate mentioned this pull request Apr 2, 2026

Backport: Improve validation and permission checks for WP_HTTP_Polling_Sync_Server WordPress/gutenberg#76987

Merged

github-actions bot mentioned this pull request Apr 2, 2026

PHP backports for WP 7.0 WordPress/gutenberg#74043

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve validation and permission checks for WP_HTTP_Polling_Sync_Server#11296

Improve validation and permission checks for WP_HTTP_Polling_Sync_Server#11296
chriszarate wants to merge 11 commits intoWordPress:trunkfrom
chriszarate:fix/http-polling-sync-server-validation

chriszarate commented Mar 19, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 19, 2026

Uh oh!

Uh oh!

westonruter Mar 26, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

peterwilsoncc Mar 30, 2026

Uh oh!

chriszarate Mar 30, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

chriszarate commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 19, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

Uh oh!

westonruter Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

peterwilsoncc Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

chriszarate Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

chriszarate commented Mar 19, 2026 •

edited

Loading

github-actions bot commented Mar 19, 2026 •

edited

Loading