WordPress / WordPress/pattern-directory
Search: Invalid ElasticSearch request on pentester submissions
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 134
- Forks
- 46
- Avg merge
- 9h 4m
- Merged PRs (30d)
- 19
Description
Describe the bug
A pentester has hit the wporg-patterns api in such a way that the pattern directory generates an invalid ElasticSearch request. Causing a 400 Bad Request warning.
I can't tell if this is supposed to work, as the code-branch doesn't currently work. I suspect this is just unexpected input to the API endpoint.
For example:
GET patterns/wp-json/wp/v2/wporg-pattern?per_page=6&curation=core&search=block
resulted in this ES query, and response:
Query piece: {"terms":{"taxonomy.wporg-pattern-keyword.term_id":"core"}}
Error: [terms] query does not support [taxonomy.wporg-pattern-keyword.term_id]
terms valid input would be an array, and well core is never going to match a term_id.. which is what leads me to think that the endpoint is not expecting a query-by-slugs.
To Reproduce
Steps to reproduce the behavior:
- Query via patterns/wp-json/wp/v2/wporg-pattern?per_page=6&curation=core&search=block
- Get a 400 error.
- To get the underlying ES error, you need to be an automattician with a WordPress.com sandbox so you can get the underlying queries.
Expected behavior
Either the API should throw a error immediately if it gets invalid input OR the fields should be validated prior to querying ES.
E_USER_WARNING: jetpack_search_abort - no_search_results_array - {"errors":{"invalid_search_api_response":["Invalid response from API - 400"]},"error_data":[]} in wp-content/plugins/pattern-directory/includes/search.php:186
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in public_html/wp-content/plugins/pattern-directory/includes/search.php at lines 152-154 and inspect the request handling through line 186. Reproduce the curation=core and search=block API request, determine the expected input for the Elasticsearch terms query, and verify that invalid input is rejected or no longer produces a 400 response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch, php
- Domain
- api, backend, search
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100