[wp-trac] [WordPress Trac] #63283: Bug in version check returned values from api.wordpress.org

[WordPress Trac]

#63283: Bug in version check returned values from api.wordpress.org
-----------------------------+------------------------------
 Reporter:  Nosoft           |       Owner:  (none)
     Type:  defect (bug)     |      Status:  new
 Priority:  normal           |   Milestone:  Awaiting Review
Component:  Upgrade/Install  |     Version:  6.7.2
 Severity:  normal           |  Resolution:
 Keywords:                   |     Focuses:
-----------------------------+------------------------------
Changes (by dd32):

 * component:  General => Upgrade/Install


Old description:

> There is a bug that is returned from api.wordpress.org/core/version-
> check/ called from wp-includes/update.php function wp_version_check.
> Call there return JSON with:
> "packages":{"full":"https:\/\/downloads.wordpress.org\/release\/bg_BG\/wordpress-6.7.2.zip","no_content":false,"new_bundled":false,"partial":false,"rollback":false}
> But in code is:
> array_map( 'esc_url', $offer['packages'] ),
> Function esc_url use in others (like ltrim), that not allow to receive
> boolean value - must be string.
> Returned value must be changed like:
> "packages":{"full":"https:\/\/downloads.wordpress.org\/release\/bg_BG\/wordpress-6.7.2.zip","no_content":"","new_bundled":"","partial":"","rollback":""}
> Bug is in: api.wordpress.org

New description:

 There is a bug that is returned from api.wordpress.org/core/version-check/
 called from wp-includes/update.php function wp_version_check.
 Call there return JSON with:
 `"packages":{"full":"https:\/\/downloads.wordpress.org\/release\/bg_BG\/wordpress-6.7.2.zip","no_content":false,"new_bundled":false,"partial":false,"rollback":false}`
 But in code is:
 `array_map( 'esc_url', $offer['packages'] ),`
 Function esc_url use in others (like ltrim), that not allow to receive
 boolean value - must be string.
 Returned value must be changed like:
 `"packages":{"full":"https:\/\/downloads.wordpress.org\/release\/bg_BG\/wordpress-6.7.2.zip","no_content":"","new_bundled":"","partial":"","rollback":""}`
 Bug is in: api.wordpress.org

--

Comment:

 Arguably `array_map( 'esc_url', $offer['packages'] )` can be removed from
 core, as it inherently trusts `api.wordpress.org`... it should probably be
 using `esc_url_raw()` though.

 We can look at making api.wordpress.org change it's responses for those
 keys to `''` though to match core behaviour.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/63283#comment:1>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform