REST API: Add dimension validation to sideload endpoint

src/wp-includes/media.php

@@ -16,9 +16,17 @@
  *
  * @since 4.7.0
  *
+ * @see add_image_size()
+ *
  * @global array $_wp_additional_image_sizes
  *
  * @return array Additional images size data.
+ *
+ * @phpstan-return array<string, array{
+ *                     width: non-negative-int,
+ *                     height: non-negative-int,
+ *                     crop: array{ 'left'|'center'|'right', 'top'|'center'|'bottom' }|bool,
+ *                 }>
  */
 function wp_get_additional_image_sizes() {
 	global $_wp_additional_image_sizes;
@@ -296,6 +304,10 @@ function image_downsize( $id, $size = 'medium' ) {
  *     @type string $0 The x crop position. Accepts 'left', 'center', or 'right'.
  *     @type string $1 The y crop position. Accepts 'top', 'center', or 'bottom'.
  * }
+ *
+ * @phpstan-param non-negative-int $width
+ * @phpstan-param non-negative-int $height
+ * @phpstan-param array{ 'left'|'center'|'right', 'top'|'center'|'bottom' }|bool $crop
  */
 function add_image_size( $name, $width = 0, $height = 0, $crop = false ) {
 	global $_wp_additional_image_sizes;
@@ -908,8 +920,14 @@ function get_intermediate_image_sizes() {
  *
  * @return array[] Associative array of arrays of image sub-size information,
  *                 keyed by image size name.
+ *
+ * @phpstan-return array<string, array{
+ *                     width: non-negative-int,
+ *                     height: non-negative-int,
+ *                     crop: array{ 'left'|'center'|'right', 'top'|'center'|'bottom' }|bool,
+ *                 }>
  */
-function wp_get_registered_image_subsizes() {
+function wp_get_registered_image_subsizes(): array {
 	$additional_sizes = wp_get_additional_image_sizes();
 	$all_sizes        = array();
 

src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -2117,6 +2117,123 @@ public function sideload_item_permissions_check( $request ) {
 		return $this->edit_media_item_permissions_check( $request );
 	}
 
+	/**
+	 * Validates that uploaded image dimensions are appropriate for the specified image size.
+	 *
+	 * @since 7.1.0
+	 *
+	 * @param int    $width         Uploaded image width.
+	 * @param int    $height        Uploaded image height.
+	 * @param string $image_size    The target image size name.
+	 * @param int    $attachment_id The attachment ID.
+	 * @return true|WP_Error True if valid, WP_Error if invalid.
+	 */
+	private function validate_image_dimensions( int $width, int $height, string $image_size, int $attachment_id ) {
+		// All image sizes require positive dimensions.
+		if ( $width <= 0 || $height <= 0 ) {
+			return new WP_Error(
+				'rest_upload_invalid_dimensions',
+				__( 'Uploaded image must have positive dimensions.' ),
+				array( 'status' => 400 )
+			);
+		}
+
+		// 'original' size: should match original attachment dimensions.
+		if ( 'original' === $image_size ) {
+			$metadata = wp_get_attachment_metadata( $attachment_id, true );
+			if ( is_array( $metadata ) && isset( $metadata['width'], $metadata['height'] ) ) {
+				$expected_width  = (int) $metadata['width'];
+				$expected_height = (int) $metadata['height'];
+
+				if ( $width !== $expected_width || $height !== $expected_height ) {
+					return new WP_Error(
+						'rest_upload_dimension_mismatch',
+						sprintf(
+							/* translators: 1: Actual width, 2: actual height, 3: expected width, 4: expected height. */
+							__( 'Uploaded image dimensions (%1$dx%2$d) do not match original image dimensions (%3$dx%4$d).' ),
+							$width,
+							$height,
+							$expected_width,
+							$expected_height
+						),
+						array( 'status' => 400 )
+					);
+				}
+			}
+			return true;
+		}
+
+		// 'full' size (PDF thumbnails) and 'scaled': no further constraints.
+		if ( in_array( $image_size, array( 'full', 'scaled' ), true ) ) {
+			return true;
+		}
+
+		// Regular image sizes: validate against registered size constraints.
+		$registered_sizes = wp_get_registered_image_subsizes();
+
+		if ( ! isset( $registered_sizes[ $image_size ] ) ) {
+			return new WP_Error(
+				'rest_upload_unknown_size',
+				__( 'Unknown image size.' ),
+				array( 'status' => 400 )
+			);
+		}
+
+		$size_data  = $registered_sizes[ $image_size ];
+		$max_width  = (int) $size_data['width'];
+		$max_height = (int) $size_data['height'];
+
+		// Validate dimensions don't exceed the registered size maximums.
+		// Allow 1px tolerance for rounding differences.
+		$tolerance = 1;
+
+		if ( $this->dimension_exceeds_max( $width, $max_width, $tolerance ) ) {
+			return new WP_Error(
+				'rest_upload_dimension_mismatch',
+				sprintf(
+					/* translators: 1: Image size name, 2: maximum width, 3: actual width. */
+					__( 'Uploaded image width (%3$d) exceeds maximum for "%1$s" size (%2$d).' ),
+					$image_size,
+					$max_width,
+					$width
+				),
+				array( 'status' => 400 )
+			);
+		}
+
+		if ( $this->dimension_exceeds_max( $height, $max_height, $tolerance ) ) {
+			return new WP_Error(
+				'rest_upload_dimension_mismatch',
+				sprintf(
+					/* translators: 1: Image size name, 2: maximum height, 3: actual height. */
+					__( 'Uploaded image height (%3$d) exceeds maximum for "%1$s" size (%2$d).' ),
+					$image_size,
+					$max_height,
+					$height
+				),
+				array( 'status' => 400 )
+			);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Checks whether a dimension exceeds the maximum allowed value.
+	 *
+	 * A maximum of zero means the dimension is unconstrained.
+	 *
+	 * @since 7.1.0
+	 *
+	 * @param int $value     The actual dimension in pixels.
+	 * @param int $max       The maximum allowed dimension in pixels. Zero means no constraint.
+	 * @param int $tolerance Pixel tolerance allowed for rounding differences.
+	 * @return bool True if the value exceeds the maximum plus tolerance.
+	 */
+	private function dimension_exceeds_max( int $value, int $max, int $tolerance ): bool {
+		return $max > 0 && $value > $max + $tolerance;
+	}
+
 	/**
 	 * Side-loads a media file without creating a new attachment.
 	 *
@@ -2194,8 +2311,49 @@ public function sideload_item( WP_REST_Request $request ) {
 		$type = $file['type'];
 		$path = $file['file'];
 
+		/** @var non-empty-string $image_size */
 		$image_size = $request['image_size'];
 
+		/*
+		 * Validate raster sub-sizes before storing them. Source-format companion
+		 * originals (e.g. a HEIC or JXL kept next to its JPEG derivative) are
+		 * exempt: their dimensions are neither validated nor recorded, and the
+		 * source format may not be readable by wp_getimagesize() at all.
+		 */
+		if ( self::IMAGE_SIZE_SOURCE_ORIGINAL !== $image_size ) {
+			/*
+			 * Read the dimensions up front. A file whose dimensions cannot be
+			 * read is corrupted or an unsupported format and must be rejected
+			 * rather than silently stored with zero dimensions.
+			 */
+			$size = wp_getimagesize( $path );
+
+			if ( ! $size ) {
+				// Clean up the uploaded file.
+				wp_delete_file( $path );
+				return new WP_Error(
+					'rest_upload_invalid_image',
+					__( 'Could not read image dimensions. The file may be corrupted or an unsupported format.' ),
+					array( 'status' => 400 )
+				);
+			}
+
+			/*
+			 * Validate the dimensions match the expected size. An array
+			 * $image_size represents multiple registered sizes sharing a single
+			 * file; those are handled by the per-size branch below, so only
+			 * scalar sizes are validated here.
+			 */
+			if ( ! is_array( $image_size ) ) {
+				$validation = $this->validate_image_dimensions( $size[0], $size[1], $image_size, $attachment_id );
+				if ( is_wp_error( $validation ) ) {
+					// Clean up the uploaded file.
+					wp_delete_file( $path );
+					return $validation;
+				}
+			}
+		}
+
 		// Build sub-size data to return to the client.
 		// The client accumulates these and sends them all to the finalize
 		// endpoint, which writes the metadata in a single operation. This