Problem
Two strategies read superglobals raw, with no wp_unslash and no sanitization:
lib/Strategies/AdminScreenResolver.php — return $_REQUEST['page'] === $slug; plus three sibling reads that return raw $_REQUEST values to callers (getCurrentScreen(), getCurrentAction()).phpnomad/translate lib/Providers/HeaderLanguageProvider.php — explode(',', $_SERVER['HTTP_ACCEPT_LANGUAGE']) on an attacker-controlled header.
Both ship inside WordPress plugins built on the framework and are flagged by WordPress.org review tooling (sibling of a finding the Siren plugin received in review).
Desired outcome
Sanitize at the boundary: sanitize_key( wp_unslash( $_REQUEST['page'] ?? '' ) )-style reads in AdminScreenResolver, and validation of the Accept-Language value against a locale pattern (rather than exploding the raw header) in HeaderLanguageProvider. No behavior change for legitimate values.
Notes
Surfaced by the Siren WordPress plugin's wp.org review simulation. Related boundary-hygiene issues: #31, #32, #33.
Problem
Two strategies read superglobals raw, with no
wp_unslashand no sanitization:lib/Strategies/AdminScreenResolver.php—return $_REQUEST['page'] === $slug;plus three sibling reads that return raw$_REQUESTvalues to callers (getCurrentScreen(),getCurrentAction()).phpnomad/translatelib/Providers/HeaderLanguageProvider.php—explode(',', $_SERVER['HTTP_ACCEPT_LANGUAGE'])on an attacker-controlled header.Both ship inside WordPress plugins built on the framework and are flagged by WordPress.org review tooling (sibling of a finding the Siren plugin received in review).
Desired outcome
Sanitize at the boundary:
sanitize_key( wp_unslash( $_REQUEST['page'] ?? '' ) )-style reads in AdminScreenResolver, and validation of the Accept-Language value against a locale pattern (rather than exploding the raw header) in HeaderLanguageProvider. No behavior change for legitimate values.Notes
Surfaced by the Siren WordPress plugin's wp.org review simulation. Related boundary-hygiene issues: #31, #32, #33.