[wp-trac] [WordPress Trac] #55853: Use of unsanitized data in wp_ajax_dashboard_widgets()

[WordPress Trac]

#55853: Use of unsanitized data in wp_ajax_dashboard_widgets()
-------------------------------------+-------------------------------------
 Reporter:  hilayt24                 |       Owner:  (none)
     Type:  enhancement              |      Status:  new
 Priority:  normal                   |   Milestone:  6.1
Component:  Widgets                  |     Version:
 Severity:  major                    |  Resolution:
 Keywords:  needs-patch good-first-  |     Focuses:  administration,
  bug                                |  coding-standards
-------------------------------------+-------------------------------------

Comment (by TimothyBlynJacobs):

 I'm actually not sure if we'd want to `sanitize_key`. It would mean that
 other values could get coerced into one of the correct values by
 `sanitize_key`. For instance `dashboard$_primary` would get sanitized to
 `dashboard_primary` which would make it through this conditional
 correctly, but the global would still be invalid and any other plugins
 that would be looking for the correct values wouldn't trigger.

 Those kind of mismatches can also end up ''causing'' security issues in
 some cases. It's best to just compare this to a strict list of allowed
 items like we are already doing IMO.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/55853#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform