\n" ),
// A `mailto:` URL is an allowed protocol, and a relative path whose colon follows a non-scheme segment is not a scheme at all.
array( "$two_paragraphs\n\n\n
\n";
return array(
@@ -129,6 +133,19 @@ public function data_invalid_content() {
array( 'rest_pattern_invalid_blocks', "\n
This is some content.
\n" ),
array( 'rest_pattern_invalid_blocks', "\n
\n
Fake nested block.
\n
\n" ),
+ // Registered core blocks the editor hides from the inserter must be rejected on the server too.
+ array( 'rest_pattern_disallowed_blocks', "$three_paragraphs\n\n\n\n" ),
+ array( 'rest_pattern_disallowed_blocks', "$three_paragraphs\n\n[gallery]" ),
+ array( 'rest_pattern_disallowed_blocks', "\n
[gallery]
\n" ),
+ // `core/pattern` splices in another pattern by slug on render, the indirection `core/block` is blocked for.
+ array( 'rest_pattern_disallowed_blocks', "$three_paragraphs\n\n" ),
+ // A `\n\n` inside a delimiter still parses in stored content; normalising it away must not hide the block.
+ array( 'rest_pattern_disallowed_blocks', "$three_paragraphs\n\n\n
[gallery]
\n" ),
+
+ // Interactivity directives in a block's HTML would drive a trusted store from submitted markup.
+ array( 'rest_pattern_interactivity_directive', "$two_paragraphs\n\n\n
x
\n" ),
+ array( 'rest_pattern_interactivity_directive', "$two_paragraphs\n\n\n\n" ),
+
// A parent-only block (`core/page-list-item` belongs to `core/page-list`) used standalone is out
// of context. The second also carries a script URL, but the context check rejects it first.
array( 'rest_pattern_invalid_block_context', "$two_paragraphs\n\n" ),
@@ -160,6 +177,33 @@ public function data_invalid_content() {
);
}
+ /**
+ * A `wporg/*` block is registered globally but must never be accepted in a pattern.
+ *
+ * This is the entry point the reported moderator-XSS and cross-blog-disclosure chains relied on:
+ * the editor hides `wporg/*` blocks, but the server accepted any registered block.
+ */
+ public function test_wporg_blocks_are_disallowed() {
+ register_block_type( 'wporg/test-block', array( 'apiVersion' => 2 ) );
+
+ try {
+ wp_set_current_user( self::$user );
+
+ $content = self::TWO_PARAGRAPHS . "\n\n";
+
+ $request = new WP_REST_Request( 'POST', '/wp/v2/wporg-pattern/' . self::$pattern_id );
+ $request->set_header( 'content-type', 'application/json' );
+ $request->set_body( wp_json_encode( array( 'content' => $content ) ) );
+
+ $response = rest_do_request( $request );
+
+ $this->assertTrue( $response->is_error() );
+ $this->assertSame( 'rest_pattern_disallowed_blocks', $response->get_data()['code'] );
+ } finally {
+ unregister_block_type( 'wporg/test-block' );
+ }
+ }
+
/**
* Test a block that's detected as spam should be pending.
*/
diff --git a/public_html/wp-content/plugins/pattern-translations/includes/cron.php b/public_html/wp-content/plugins/pattern-translations/includes/cron.php
index 5889285a..1c7f6e41 100644
--- a/public_html/wp-content/plugins/pattern-translations/includes/cron.php
+++ b/public_html/wp-content/plugins/pattern-translations/includes/cron.php
@@ -95,7 +95,13 @@ function () {
if ( $translated ) {
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo "\t{$locale} - " . ( $translated->ID ? 'Updating' : 'Creating' ) . " Translated pattern.\n";
- create_or_update_translated_pattern( $translated );
+ $result = create_or_update_translated_pattern( $translated );
+ if ( is_wp_error( $result ) ) {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- cron output isn't reliably captured; the failure has to reach the server log.
+ error_log( "Pattern translation import failed for {$pattern->name} ({$locale}): " . $result->get_error_message() );
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ echo "\t{$locale} - ERROR: {$result->get_error_message()}\n";
+ }
} else {
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo "\t{$locale} - No Translations exist yet.\n";
diff --git a/public_html/wp-content/plugins/pattern-translations/pattern-translations.php b/public_html/wp-content/plugins/pattern-translations/pattern-translations.php
index 1cb0d917..8cc03d2f 100644
--- a/public_html/wp-content/plugins/pattern-translations/pattern-translations.php
+++ b/public_html/wp-content/plugins/pattern-translations/pattern-translations.php
@@ -7,6 +7,8 @@
*/
namespace WordPressdotorg\Pattern_Translations;
+use function WordPressdotorg\Pattern_Directory\Pattern_Post_Type\is_block_allowed_in_pattern;
+use function WordPressdotorg\Pattern_Directory\Pattern_Validation\content_has_block_directives;
use const WordPressdotorg\Pattern_Directory\Pattern_Post_Type\POST_TYPE;
const GLOTPRESS_PROJECT = 'patterns/core';
@@ -27,10 +29,48 @@
require __DIR__ . '/includes/cli-commands.php';
}
+/**
+ * Whether translated pattern HTML stays within what the directory accepts from direct submissions.
+ *
+ * Translator-supplied strings are assembled into stored markup without passing through the REST
+ * validators, so the block allowlist and Interactivity-directive checks (the two a translated string
+ * could realistically violate) run here. The remaining REST checks still apply to the English parent.
+ *
+ * @param string $html The assembled, translated pattern HTML.
+ * @return bool Whether the HTML is safe to store as a pattern.
+ */
+function is_translated_content_allowed( $html ) {
+ $blocks = parse_blocks( $html );
+ while ( count( $blocks ) > 0 ) { // phpcs:ignore -- inline count OK.
+ $block = array_shift( $blocks );
+
+ if ( ! is_null( $block['blockName'] ) && ! is_block_allowed_in_pattern( $block['blockName'] ) ) {
+ return false;
+ }
+
+ if ( ! empty( $block['innerBlocks'] ) ) {
+ $blocks = array_merge( $blocks, $block['innerBlocks'] );
+ }
+ }
+
+ return ! content_has_block_directives( $html );
+}
+
/**
* Creates or updates a localised pattern.
+ *
+ * @param Pattern $pattern The translated pattern to store.
+ *
+ * @return int|\WP_Error The pattern post ID, or an error if the content is refused or the write fails.
*/
function create_or_update_translated_pattern( Pattern $pattern ) {
+ if ( ! is_translated_content_allowed( $pattern->html ) ) {
+ return new \WP_Error(
+ 'pattern_translation_disallowed_content',
+ 'Translated pattern content contains disallowed blocks or interactivity directives.'
+ );
+ }
+
$parent = false;
if ( $pattern->parent ) {
$parent = get_post( $pattern->parent->ID );
![\"\"/](\"./pear.png\")