Automattic / Automattic/jetpack

PHP Warning: parse_str() Input variables exceeded in WPCOM_JSON_API_Endpoint::input()

Open
#46,996 0 comments 0 reactions 1 assignee Claimed by @bindlegirl View on GitHub
[Package] Connection [Status] Auto-allocated Bug
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

The `input()` method in WPCOM_JSON_API_Endpoint can trigger a PHP warning when
processing POST requests with form-urlencoded data containing more variables
than PHP's max_input_vars limit.

In class.json-api-endpoints.php, the `input()` method calls `wp_parse_str()` for
`application/x-www-form-urlencoded` content (when not valid JSON) and for
unrecognized content types:

```php
case 'application/x-www-form-urlencoded':
$return = json_decode( $input, true );
if ( $return === null ) {
wp_parse_str( $input, $return ); // Warning triggered here
}
break;
default:
wp_parse_str( $input, $return ); // Also here
break;
```

When the input contains more variables than max_input_vars, PHP emits an
E_WARNING and silently truncates the result.

One approach for dealing with this is a helper method that checks the approximate variable count before parsing. Something like:

```php
/**
* Parse a query string safely, avoiding PHP warnings when input exceeds
max_input_vars.
*
* @param string $input The query string to parse.
* @param array $result Parsed key-value pairs are stored here.
*/
private function safe_parse_str( $input, &$result ) {
$max_input_vars = (int) ini_get( 'max_input_vars' );
if (
$max_input_vars > 0
&& substr_count( $input, '&' ) >= $max_input_vars
) {
$result = array();
return;
}
wp_parse_str( $input, $result );
}
```

Then replace the two `wp_parse_str()` calls in input() with `$this->safe_parse_str()`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.