Abilities API: Normalize inputs in core information abilities

Support object inputs and comma- or whitespace-separated field lists
during direct execution. Preserve empty-selection defaults and validation
of field names. Add regression tests.

Props gziolo, jorgefilipecosta.
Fixes #66370.



git-svn-id: https://develop.svn.wordpress.org/trunk@64729 602fd350-edb4-49c9-b593-d223f7449a82

Author: gziolo

src/wp-includes/abilities.php

@@ -136,8 +136,11 @@ function wp_register_core_abilities(): void {
 				'additionalProperties' => false,
 			),
 			'execute_callback'      => static function ( $input = array() ) use ( $site_info_fields ): array {
-				$input = is_array( $input ) ? $input : array();
-				$requested_fields = ! empty( $input['fields'] ) ? $input['fields'] : $site_info_fields;
+				$input            = rest_sanitize_object( $input );
+				$requested_fields = rest_sanitize_array( $input['fields'] ?? array() );
+				if ( empty( $requested_fields ) ) {
+					$requested_fields = $site_info_fields;
+				}
 
 				$result = array();
 				foreach ( $requested_fields as $field ) {
@@ -251,9 +254,12 @@ function wp_register_core_abilities(): void {
 				'additionalProperties' => false,
 			),
 			'execute_callback'    => static function ( $input = array() ) use ( $user_info_fields ): array {
-				$input            = is_array( $input ) ? $input : array();
-				$requested_fields = ! empty( $input['fields'] ) ? $input['fields'] : $user_info_fields;
-				$current_user     = wp_get_current_user();
+				$input            = rest_sanitize_object( $input );
+				$requested_fields = rest_sanitize_array( $input['fields'] ?? array() );
+				if ( empty( $requested_fields ) ) {
+					$requested_fields = $user_info_fields;
+				}
+				$current_user = wp_get_current_user();
 
 				$all = array(
 					'id'            => $current_user->ID,
@@ -340,9 +346,12 @@ function wp_register_core_abilities(): void {
 			'execute_callback'      => static function ( $input = array() ) use ( $environment_info_fields ): array {
 				global $wpdb;
 
-				/** @var array{ fields?: string[] } $input */
-				$input            = is_array( $input ) ? $input : array();
-				$requested_fields = ! empty( $input['fields'] ) ? $input['fields'] : $environment_info_fields;
+				$input = rest_sanitize_object( $input );
+				/** @var array{ fields?: string[]|string } $input */
+				$requested_fields = rest_sanitize_array( $input['fields'] ?? array() );
+				if ( empty( $requested_fields ) ) {
+					$requested_fields = $environment_info_fields;
+				}
 
 				$db_server_info = '';
 				if ( method_exists( $wpdb, 'db_server_info' ) ) {

tests/phpunit/tests/abilities-api/wpRegisterCoreAbilities.php

@@ -454,6 +454,84 @@ public function test_core_get_environment_info_rejects_invalid_fields(): void {
 		$this->assertSame( 'ability_invalid_input', $result->get_error_code() );
 	}
 
+	/**
+	 * Tests field selection through direct execution, without REST input coercion.
+	 *
+	 * @ticket 66370
+	 *
+	 * @dataProvider data_core_ability_field_lists
+	 *
+	 * @param string         $ability_name    Ability name.
+	 * @param array|stdClass $input           Ability input.
+	 * @param array|null     $expected_fields Expected fields, or null for invalid input.
+	 */
+	public function test_core_ability_field_lists( string $ability_name, $input, ?array $expected_fields ): void {
+		$admin_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
+		$user     = wp_set_current_user( $admin_id );
+		$user->add_cap( 'view_site_health_checks' );
+
+		$ability = wp_get_ability( $ability_name );
+		$result  = $ability->execute( $input );
+
+		if ( null === $expected_fields ) {
+			$this->assertWPError( $result );
+			$this->assertSame( 'ability_invalid_input', $result->get_error_code() );
+			return;
+		}
+
+		$expected = $ability->execute();
+		$this->assertIsArray( $expected );
+		if ( ! empty( $expected_fields ) ) {
+			$expected = array_intersect_key( $expected, array_flip( $expected_fields ) );
+		}
+
+		$this->assertSameSetsWithIndex( $expected, $result );
+	}
+
+	/**
+	 * Provides array and string field selections for the core information abilities.
+	 *
+	 * @return array
+	 */
+	public static function data_core_ability_field_lists(): array {
+		$abilities = array(
+			'core/get-site-info'        => array( 'name', 'url' ),
+			'core/get-user-info'        => array( 'id', 'display_name' ),
+			'core/get-environment-info' => array( 'environment', 'php_version' ),
+		);
+		$datasets  = array();
+
+		foreach ( $abilities as $ability_name => $fields ) {
+			$cases = array(
+				'array'           => array( $fields, $fields ),
+				'csv'             => array( implode( ',', $fields ), $fields ),
+				'reversed array'  => array( array_reverse( $fields ), $fields ),
+				'reversed csv'    => array( implode( ',', array_reverse( $fields ) ), $fields ),
+				'whitespace'      => array( implode( " \t\n", $fields ), $fields ),
+				'duplicates'      => array( ', ' . implode( ',, ', $fields ) . ',' . $fields[0] . ',', $fields ),
+				'empty array'     => array( array(), array() ),
+				'empty string'    => array( '', array() ),
+				'only separators' => array( " , \t\n,, ", array() ),
+				'invalid csv'     => array( $fields[0] . ',not_a_real_field', null ),
+				'invalid array'   => array( array( $fields[0], 'not_a_real_field' ), null ),
+			);
+
+			foreach ( $cases as $case => $values ) {
+				$input = array( 'fields' => $values[0] );
+
+				$datasets[ $ability_name . ': ' . $case ] = array( $ability_name, $input, $values[1] );
+			}
+
+			$datasets[ $ability_name . ': object input' ] = array(
+				$ability_name,
+				(object) array( 'fields' => $fields ),
+				$fields,
+			);
+		}
+
+		return $datasets;
+	}
+
 	/**
 	 * Tests that all core ability schemas only use valid JSON Schema keywords.
 	 *