PHP Notice in BP_Core_oEmbed_Extension::oembed_xml_request()

[dd32]

​https://github.com/buddypress/buddypress/blob/master/src/bp-core/classes/class-bp-core-oembed-extension.php#L483-L489

The BuddyPress oEmbed api endpoint doesn't validate that a valid url is passed in before processing.

For example:

E_NOTICE: Undefined index: url in wp-content/plugins/buddypress/bp-core/classes/class-bp-core-oembed-extension.php:484

Source: GET https://buddypress.org/wp-json/oembed/1.0/embed?1C87dvZNvCO&format=xml

File: wp-content/plugins/buddypress/bp-core/classes/class-bp-core-oembed-extension.php

Suggested patch:

bp-core/classes/class-bp-core-oembed-extension.php

@@ -469 +469 @@
          * @param WP_HTTP_ResponseInterface $result  Result to send to the client. Usually a WP_REST_Response.
          * @param WP_REST_Request           $request Request used to generate the response.
          * @param WP_REST_Server            $server  Server instance.
          * @return bool
          */
         public function oembed_xml_request( $served, $result, $request, $server ) {
                 $params = $request->get_params();
 
                 if ( ! isset( $params['format'] ) || 'xml' !== $params['format'] ) {
                         return $served;
                 }
 
                 // Validate URL against our oEmbed endpoint. If not valid, bail.
                 // This is our mod to _oembed_rest_pre_serve_request().
                 $query_params = $request->get_query_params();
-                if ( false === $this->validate_url_to_item_id( $query_params['url'] ) ) {
+                if ( ! isset( $query_params['url'] ) || false === $this->validate_url_to_item_id( $query_params['url'] ) ) {
                         return $served;
                 }
 
                 // Embed links inside the request.
                 $data = $server->response_to_data( $result, false );
 
                 if ( ! class_exists( 'SimpleXMLElement' ) ) {
                         status_header( 501 );
                         die( get_status_header_desc( 501 ) );
                 }
 
                 $result = _oembed_create_xml( $data );
 
                 // Bail if there's no XML.
                 if ( ! $result ) {

[imath]

Hi @dd32

Thanks a lot for your report & patch, I’ll commit it asap 👍

[imath]

In 13157:

Validate an url param exists before processing an oEmbed XML request

Props dd32

See #8601 (trunk)

[imath]

In 13158:

Validate an url param exists before processing an oEmbed XML request

Props dd32

Fixes #8601 (9.0 branch)