WP_REST_Abilities_V1_Run_Controller::coerce_input_to_schema( mixed $input, WP_Ability $ability ): mixed

Source

private function coerce_input_to_schema( $input, WP_Ability $ability ) {
	if ( null === $input ) {
		return $input;
	}

	$schema = $ability->get_input_schema();
	if ( empty( $schema ) ) {
		return $input;
	}

	/*
	 * Only coerce input that already validates. Sanitizing invalid input can silently
	 * change which values are accepted -- `additionalProperties: false` strips unknown
	 * keys, and a non-numeric string casts to 0 -- so leaving invalid input untouched
	 * lets validate_input() reject it exactly as it does without coercion.
	 *
	 * validate_input() is asked rather than rest_validate_value_from_schema() so that the
	 * `wp_ability_validate_input` filter decides what counts as valid here as well. A filter
	 * that overrides a schema failure accepts the input, so the input is coerced; a filter
	 * that rejects otherwise valid input leaves it untouched for validate_input() to report.
	 */
	if ( is_wp_error( $ability->validate_input( $input ) ) ) {
		return $input;
	}

	$sanitized = rest_sanitize_value_from_schema( $input, $schema, 'input' );

	/*
	 * Sanitizing can still surface an error the lenient validation above did not, such as
	 * items that are unique as strings but collide once cast to integers (`uniqueItems`).
	 * The error may be returned at the top level or nested inside the returned array, so
	 * scan recursively and fall back to the raw input on any error.
	 */
	if ( $this->input_contains_error( $sanitized ) ) {
		return $input;
	}

	return $sanitized;
}

View all references View on Trac View on GitHub