[wp-trac] [WordPress Trac] #62224: The class class-wp-theme-json.php methods compute_theme_vars and to_ruleset need to be hardened

[WordPress Trac]

#62224: The class class-wp-theme-json.php methods compute_theme_vars and to_ruleset
need to be hardened
-------------------------+-----------------------------
 Reporter:  villu164     |      Owner:  (none)
     Type:  enhancement  |     Status:  new
 Priority:  normal       |  Milestone:  Awaiting Review
Component:  Themes       |    Version:  6.6.2
 Severity:  normal       |   Keywords:
  Focuses:               |
-------------------------+-----------------------------
 I first reported the issue on HackerOne and was told this can be a public
 hardening ticket.
 (https://hackerone.com/bugs?subject=user&report_id=2623479)

 The compute_theme_vars
 (https://core.trac.wordpress.org/browser/tags/6.6.2/src/wp-includes/class-
 wp-theme-json.php#L2208) and to_ruleset
 (https://core.trac.wordpress.org/browser/tags/6.6.2/src/wp-includes/class-
 wp-theme-json.php#L1900) need to be hardened and the theme.json, should be
 considered as user supplied content. Thus the before-mentioned methods
 need to adjust for that and use proper sanitization

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/62224>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform