8B. Read the request the way core wrote it at priority 5 - #67
Open
nikolaystrikhar wants to merge 1 commit into
Open
8B. Read the request the way core wrote it at priority 5#67nikolaystrikhar wants to merge 1 commit into
nikolaystrikhar wants to merge 1 commit into
Conversation
`wp_magic_quotes()` is what adds the slashes `wp_unslash()` takes off, and wp-settings.php calls it *after* `do_action( 'plugins_loaded' )`. Both conflict gates and the redirect run at priority 5, so every value they read is exactly as the SAPI left it and `wp_unslash()` there is a plain `stripslashes_deep()` over user input. It costs a destination and a gate. An admin at /wp-admin/edit.php?s=C:\projects who trips a conflict is sent back to a search for "C:projects" -- re-rendering the screen the user asked for being the entire point of the redirect -- and in the action gate `?action=\` strips to '' while `?action2=-\1` strips to '-1', which are the two values that gate reads as "nothing is being asked for". Both are then admitted, resolved and exited out from under work core still goes on to dispatch, by the class whose job is refusing exactly those requests. `Conflict\Rewriter` keeps both of its uses: it runs from `wp_admin_notice_markup` at admin render time, long after the slashing, where the idiom is the correct one. Where these can still run after the slashing is the inline fallback a too-late boot reports, and the direction is safe there: a slashed action arg only ever reads as more of an action than it is, and a slashed URI costs a stray backslash in a re-encoded query arg rather than a deleted one.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
nikolaystrikhar
force-pushed
the
50-unslash-after-core-slashes
branch
2 times, most recently
from
August 24, 2026 14:02
984dbc7 to
f9e5122
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What: drops
wp_unslash()from the three reads that run atplugins_loadedpriority 5 —Conflict\Resolver's$_SERVER['REQUEST_URI'], andConflict\Gatekeeper's action arg and script-name candidate.Usage:
/wp-admin/edit.php?s=C:\projectsnow redirects back to that search rather than to one forC:projects, and?action=\is refused rather than resolved out from under core.Why this way:
Core slashes after us, not before.
wp_magic_quotes()is whatwp_unslash()undoes, andwp-settings.phpcalls it afterdo_action( 'plugins_loaded' )— so at priority 5 it is a plainstripslashes_deep()over the URL bar.The gate was the expensive half.
?action=\strips to''and?action2=-\1to-1, which are exactly the two values the gate reads as asking for nothing — a bypass in the class whose job is refusing those requests.Conflict\Rewriterkeeps both of its uses. It runs fromwp_admin_notice_markupat render time, after the slashing, where the idiom is right.