• Hi WP Fastest Cache team!

    We found issue of JSON validation inside WpFastestCacheCreateCache::is_json() method. In some cases when we build API using custom URI (e.g. http://api.host.com/somequery) we got “<!– html is corrupted –>” string injection before output buffer. This issue refer to file %wp_root%/wp-content/plugins/wp-fastest-cache/inc/cache.php (line 524).

    Please find below our implementation for is_json() method which fix issue.

    
                    public function is_json($buffer){
                            @json_decode($buffer);
                            return (json_last_error() === JSON_ERROR_NONE);
                    }
    

    The key idea in checking whole output buffer (fastest way) and if buffer is a json string then return true. This fix will cover all cases with json buffer.

    Please find below our patch file plugin_wp-fastest-cache_is_json_fix.patch:

    
    diff --git a/www/wp-content/plugins/wp-fastest-cache/inc/cache.php b/www/wp-content/plugins/wp-fastest-cache/inc/cache.php
    index 856c1c7..9b08ef3 100644
    --- a/www/wp-content/plugins/wp-fastest-cache/inc/cache.php
    +++ b/www/wp-content/plugins/wp-fastest-cache/inc/cache.php
    @@ -522,23 +522,8 @@
     		}
     
     		public function is_json($buffer){
    -			if(isset($_SERVER["HTTP_ACCEPT"]) && preg_match("/json/i", $_SERVER["HTTP_ACCEPT"])){
    -				return true;
    -			}
    -
    -			if(preg_match("/^\/wp-json/", $_SERVER["REQUEST_URI"])){
    -				return true;
    -			}
    -
    -			if(preg_match("/^\s*\{\s*[\"\']/i", $buffer)){
    -				return true;
    -			}
    -
    -			if(preg_match("/^\s*\[\s*\{\s*[\"\']/i", $buffer)){
    -				return true;
    -			}
    -
    -			return false;
    +                        @json_decode($buffer);
    +                        return (json_last_error() === JSON_ERROR_NONE);
     		}
     
     		public function is_xml($buffer){
    @@ -1087,4 +1072,4 @@
     			return false;
     		}
     	}
    -?>
    \ No newline at end of file
    +?>
    

    Best regards,
    Alex

Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)

The topic ‘JSON validation issue fix’ is closed to new replies.