Skip to content

Abilities API: add filters for input and output validation #10557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: trunk
Choose a base branch
from
Open

Abilities API: add filters for input and output validation #10557

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
323d2ae
Add filters
priethor Nov 26, 2025
19a5d11
Add tests
priethor Nov 26, 2025
1c8be4a
Don't run the filters if there is nothing to validate (no input/ouput…
priethor Nov 26, 2025
39ec0e9
Output doesn't have schema restrictions as input, so fire the hook fo…
priethor Nov 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 51 additions & 17 deletions src/wp-includes/abilities-api/class-wp-ability.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,7 +479,7 @@ public function validate_input( $input = null ) {

$valid_input = rest_validate_value_from_schema( $input, $input_schema, 'input' );
if ( is_wp_error( $valid_input ) ) {
return new WP_Error(
$is_valid = new WP_Error(
'ability_invalid_input',
sprintf(
/* translators: %1$s ability name, %2$s error message. */
Expand All @@ -488,9 +488,26 @@ public function validate_input( $input = null ) {
$valid_input->get_error_message()
)
);
} else {
$is_valid = true;
}

return true;
/**
* Filters the input validation result for an ability.
*
* Allows developers to add custom validation logic on top of the default
* JSON Schema validation. If default validation already failed, the filter
* receives the WP_Error object and can add additional error information or
* override it. If default validation passed, the filter can add additional
* validation checks and return a WP_Error if those checks fail.
*
* @since 7.0.0
*
* @param true|WP_Error $is_valid The validation result from default validation.
* @param mixed $input The input data being validated.
* @param string $ability_name The name of the ability.
Comment on lines +506 to +508
Copy link
Member

@westonruter westonruter Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extra space can be removed:

Suggested change
* @param true|WP_Error $is_valid The validation result from default validation.
* @param mixed $input The input data being validated.
* @param string $ability_name The name of the ability.
* @param true|WP_Error $is_valid The validation result from default validation.
* @param mixed $input The input data being validated.
* @param string $ability_name The name of the ability.

*/
return apply_filters( 'wp_ability_validate_input', $is_valid, $input, $this->name );
Copy link
Member

@westonruter westonruter Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm wary of plugins doing the right thing here. This would be safer:

Consider the similar logic in the Customizer:

wordpress-develop/src/wp-includes/class-wp-customize-setting.php

Lines 602 to 622 in d676a07

$validity = new WP_Error();
/**
* Validates a Customize setting value.
*
* Plugins should amend the `$validity` object via its `WP_Error::add()` method.
*
* The dynamic portion of the hook name, `$this->ID`, refers to the setting ID.
*
* @since 4.6.0
*
* @param WP_Error $validity Filtered from `true` to `WP_Error` when invalid.
* @param mixed $value Value of the setting.
* @param WP_Customize_Setting $setting WP_Customize_Setting instance.
*/
$validity = apply_filters( "customize_validate_{$this->id}", $validity, $value, $this );
if ( is_wp_error( $validity ) && ! $validity->has_errors() ) {
$validity = true;
}
return $validity;

So think this could rather be, with even more hardening to handle the case where a plugin erroneously returns false:

Suggested change
return apply_filters( 'wp_ability_validate_input', $is_valid, $input, $this->name );
$validity = apply_filters( 'wp_ability_validate_input', $is_valid, $input, $this->name );
if ( ! is_wp_error( $validity ) || ! $validity->has_errors() ) {
$validity = true;
}
return $validity;

Or maybe returning false should result in a generic invalidity WP_Error being created.

}

/**
Expand Down Expand Up @@ -567,23 +584,40 @@ protected function do_execute( $input = null ) {
protected function validate_output( $output ) {
$output_schema = $this->get_output_schema();
if ( empty( $output_schema ) ) {
return true;
}

$valid_output = rest_validate_value_from_schema( $output, $output_schema, 'output' );
if ( is_wp_error( $valid_output ) ) {
return new WP_Error(
'ability_invalid_output',
sprintf(
/* translators: %1$s ability name, %2$s error message. */
__( 'Ability "%1$s" has invalid output. Reason: %2$s' ),
esc_html( $this->name ),
$valid_output->get_error_message()
)
);
$is_valid = true;
} else {
$valid_output = rest_validate_value_from_schema( $output, $output_schema, 'output' );
if ( is_wp_error( $valid_output ) ) {
$is_valid = new WP_Error(
'ability_invalid_output',
sprintf(
/* translators: %1$s ability name, %2$s error message. */
__( 'Ability "%1$s" has invalid output. Reason: %2$s' ),
esc_html( $this->name ),
Copy link
Member

@westonruter westonruter Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is HTML escaping appropriate here? It could be rendered into JSON in which case the HTML entities would be wrong.

Suggested change
esc_html( $this->name ),
$this->name,

$valid_output->get_error_message()
)
);
} else {
$is_valid = true;
}
}

return true;
/**
* Filters the output validation result for an ability.
*
* Allows developers to add custom validation logic on top of the default
* JSON Schema validation. If default validation already failed, the filter
* receives the WP_Error object and can add additional error information or
* override it. If default validation passed, the filter can add additional
* validation checks and return a WP_Error if those checks fail.
*
* @since 7.0.0
*
* @param true|WP_Error $is_valid The validation result from default validation.
* @param mixed $output The output data being validated.
* @param string $ability_name The name of the ability.
*/
return apply_filters( 'wp_ability_validate_output', $is_valid, $output, $this->name );
Copy link
Member

@westonruter westonruter Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto above:

Suggested change
return apply_filters( 'wp_ability_validate_output', $is_valid, $output, $this->name );
$validity = apply_filters( 'wp_ability_validate_output', $is_valid, $output, $this->name );
if ( ! is_wp_error( $validity ) || ! $validity->has_errors() ) {
$validity = true;
}
return $validity;

}

/**
Expand Down
Loading
Loading