Add sanitize_callback to REST API registration args

Added 'sanitize_callback' to the 'name', 'baseUrl', 'serverId', and 'publicKey' arguments in the REST API registration route to ensure input is properly sanitized. Updated handle_registration() to use sanitized parameters directly from the request, as sanitization is now handled by the route definition.

Author: pfefferle

includes/rest/class-fasp-controller.php

@@ -64,25 +64,29 @@ public function register_routes() {
 					'permission_callback' => array( $this, 'registration_permission_check' ),
 					'args'                => array(
 						'name'      => array(
-							'required'    => true,
-							'type'        => 'string',
-							'description' => 'The name of the FASP.',
+							'required'          => true,
+							'type'              => 'string',
+							'description'       => 'The name of the FASP.',
+							'sanitize_callback' => 'sanitize_text_field',
 						),
 						'baseUrl'   => array(
-							'required'    => true,
-							'type'        => 'string',
-							'format'      => 'uri',
-							'description' => 'The base URL of the FASP.',
+							'required'          => true,
+							'type'              => 'string',
+							'format'            => 'uri',
+							'description'       => 'The base URL of the FASP.',
+							'sanitize_callback' => 'esc_url_raw',
 						),
 						'serverId'  => array(
-							'required'    => true,
-							'type'        => 'string',
-							'description' => 'The server ID generated by the FASP.',
+							'required'          => true,
+							'type'              => 'string',
+							'description'       => 'The server ID generated by the FASP.',
+							'sanitize_callback' => 'sanitize_text_field',
 						),
 						'publicKey' => array(
-							'required'    => true,
-							'type'        => 'string',
-							'description' => 'The FASP public key, base64 encoded.',
+							'required'          => true,
+							'type'              => 'string',
+							'description'       => 'The FASP public key, base64 encoded.',
+							'sanitize_callback' => 'sanitize_text_field',
 						),
 					),
 				),
@@ -200,22 +204,22 @@ private function sign_response( $response, $content ) { // phpcs:ignore Variable
 	 * @return \WP_REST_Response|\WP_Error The response or error.
 	 */
 	public function handle_registration( $request ) {
-		$params = $request->get_json_params();
 		// Use the Application user's existing RSA keypair instead of generating new keys.
 		$blog_user_id = Actors::APPLICATION_USER_ID;
 		$public_key   = Actors::get_public_key( $blog_user_id );
 
 		// Generate unique FASP ID.
 		$fasp_id = $this->generate_unique_id();
 
-		$fasp_public_key = \sanitize_text_field( $params['publicKey'] );
+		// Parameters are already sanitized via sanitize_callback in register_routes().
+		$fasp_public_key = $request->get_param( 'publicKey' );
 
 		// Store registration request (pending approval).
 		$registration_data = array(
 			'fasp_id'                     => $fasp_id,
-			'name'                        => \sanitize_text_field( $params['name'] ),
-			'base_url'                    => \esc_url_raw( $params['baseUrl'] ),
-			'server_id'                   => \sanitize_text_field( $params['serverId'] ),
+			'name'                        => $request->get_param( 'name' ),
+			'base_url'                    => $request->get_param( 'baseUrl' ),
+			'server_id'                   => $request->get_param( 'serverId' ),
 			'fasp_public_key'             => $fasp_public_key,
 			'fasp_public_key_fingerprint' => Fasp::get_public_key_fingerprint( $fasp_public_key ),
 			'server_public_key'           => $public_key,