Skip to content

Added WooCommerce request verification token #1253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vytisbulkevicius merged 3 commits into from
Mar 3, 2026
+56 −0
Merged

Added WooCommerce request verification token #1253

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ee671ed
fix: add WooCommerce request verification token
girishpanchal30 Mar 2, 2026
6b3357d
fix: enhance wc request validation
girishpanchal30 Mar 2, 2026
59e2aef
Refactor is_woocommerce_request function condition
vytisbulkevicius Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions classes/Visualizer/Source/Json.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -457,6 +457,17 @@ function( $headers ) {
}
}

// Check if this is a WooCommerce endpoint request and add verification token.
if ( $this->is_woocommerce_request( $url ) ) {
// Generate a unique token for this specific request.
$token = wp_generate_password( 32, false );
set_transient( 'visualizer_wc_token_' . $token, time(), 60 );
if ( ! isset( $args['headers'] ) ) {
$args['headers'] = array();
}
$args['headers']['X-Visualizer-Token'] = $token;
Comment on lines +460 to +468
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description says the token is validated (e.g., via woocommerce_rest_check_permissions), but in this repo the token is only generated/stored and sent; there is no code that reads X-Visualizer-Token or checks/deletes the corresponding transient. As-is, this doesn’t provide any additional protection and leaves behind short-lived transients on every matched request. Add server-side verification on REST requests (read the header, get_transient()/delete_transient() for single-use, and reject when missing/invalid).

Copilot uses AI. Check for mistakes.
}
Comment on lines +460 to +469
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New security behavior (token generation/transient storage + conditional header injection) isn’t covered by the existing PHPUnit tests. Add a unit test that stubs HTTP via pre_http_request to assert the header is (or is not) set for WooCommerce URLs, and that the transient lifecycle behaves as expected.

Copilot uses AI. Check for mistakes.

do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Connecting to %s with args = %s ', $url, print_r( $args, true ) ), 'debug', __FILE__, __LINE__ );
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

themeisle_log_event logs print_r( $args, true ). With this change, the log payload will include the newly generated X-Visualizer-Token header, which makes the token retrievable from logs during its validity window. Consider redacting this header (and other sensitive headers) from the logged args or skipping verbose logging for these internal WooCommerce requests.

Suggested change
do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Connecting to %s with args = %s ', $url, print_r( $args, true ) ), 'debug', __FILE__, __LINE__ );
// Avoid logging sensitive headers such as X-Visualizer-Token.
$log_args = $args;
if ( isset( $log_args['headers'] ) && is_array( $log_args['headers'] ) ) {
unset( $log_args['headers']['X-Visualizer-Token'] );
}
do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Connecting to %s with args = %s ', $url, print_r( $log_args, true ) ), 'debug', __FILE__, __LINE__ );

Copilot uses AI. Check for mistakes.
return wp_remote_request( $url, $args );
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code performs a server-side HTTP request to a user-controlled URL using wp_remote_request with no host or protocol restrictions. An authenticated attacker who can reach the JSON import AJAX endpoints (e.g. via visualizer-json-get-roots / visualizer-json-get-data) can supply an arbitrary URL (including internal hosts like http://127.0.0.1/ or cloud metadata IPs), turning this into an SSRF primitive that can probe internal services and, when the response is JSON, exfiltrate data via the chart preview. To mitigate, validate and restrict $_args['url']/$this->_url to an allowlist of expected domains or at minimum block private/reserved IP ranges and non-HTTP(S) schemes before calling wp_remote_request.

Copilot uses AI. Check for mistakes.
}
Expand Down Expand Up @@ -488,6 +499,51 @@ public function refresh( $series ) {
return true;
}

/**
* Check if the URL is a WooCommerce endpoint request.
*
* @access private
* @param string $url The URL to check.
* @return bool True if it's a WooCommerce request, false otherwise.
*/
private function is_woocommerce_request( $url ) {
if ( empty( $url ) ) {
return false;
}

$parsed_url = function_exists( 'wp_parse_url' ) ? wp_parse_url( $url ) : parse_url( $url );
if ( empty( $parsed_url ) || empty( $parsed_url['host'] ) || empty( $parsed_url['path'] ) ) {
return false;
}

$site_url = function_exists( 'home_url' ) ? home_url() : ( function_exists( 'site_url' ) ? site_url() : '' );
$site_parts = $site_url ? ( function_exists( 'wp_parse_url' ) ? wp_parse_url( $site_url ) : parse_url( $site_url ) ) : array();
if ( empty( $site_parts['host'] ) ) {
return false;
}

$target_host = strtolower( $parsed_url['host'] );
$site_host = strtolower( $site_parts['host'] );
if ( $target_host !== $site_host ) {
return false;
}

$path = '/' . ltrim( $parsed_url['path'], '/' );
$wc_patterns = array(
'/wp-json/wc/',
'/wp-json/wc-analytics/',
'/wc-analytics/',
);

foreach ( $wc_patterns as $pattern ) {
if ( strpos( $path, $pattern ) !== false ) {
return true;
}
}

return false;
}

/**
* Returns source name.
*
Expand Down
Loading