WordPress.org
Get WordPress

Plugin Directory

Changeset 3723184


Ignore:
Timestamp:
10/01/2026 12:56:25 PM (3 weeks ago)
Author:
octanist
Message:

Release 4.1.2: validate form session and client IDs before sanitizing them, so oversized values in form submissions can no longer slow down the site

Location:
octanist
Files:
8 edited
1 copied

Legend:

Unmodified
Added
Removed

  • octanist/tags/4.1.2/README.md

    r3680970 r3723184  
    55**Requires at least:** 6.0
    66**Tested up to:** 7.1
    7 **Stable tag:** 4.1.1
     7**Stable tag:** 4.1.2
    88**License:** GPLv2 or later
    99**License URI:** https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4747
    4848## Changelog
     49
     50### 4.1.2
     51
     52- Form capture accepts only valid Octanist session and client IDs, so oversized values sent with a form submission can no longer slow down the site.
    4953
    5054### 4.1.1

  • octanist/tags/4.1.2/includes/forms/class-octanist-form-capture.php

    r3608511 r3723184  
    8484
    8585        if (!empty($_COOKIE['octa_cid']) && is_string($_COOKIE['octa_cid'])) {
    86             $payload['cid'] = sanitize_text_field(wp_unslash($_COOKIE['octa_cid']));
     86            $cid = self::clean_id($_COOKIE['octa_cid']);
     87            if ($cid !== null) {
     88                $payload['cid'] = $cid;
     89            }
    8790        }
    8891
    … …  
    392395    private static function clean_sid(string $sid): ?string
    393396    {
    394         $sid = sanitize_text_field(wp_unslash($sid));
    395         $sid = trim($sid);
    396         return $sid === '' ? null : $sid;
     397        return self::clean_id($sid);
     398    }
     399
     400    /**
     401     * Session and client ids from the pixel are UUIDs. They arrive from anyone who submits
     402     * a form, so anything that is not a short plain id is dropped here, before
     403     * sanitize_text_field, which slows down sharply on long crafted input.
     404     */
     405    private static function clean_id(string $value): ?string
     406    {
     407        $value = trim(wp_unslash($value));
     408        if ($value === '' || strlen($value) > 128 || !preg_match('/^[A-Za-z0-9._-]+$/', $value)) {
     409            return null;
     410        }
     411        return $value;
    397412    }
    398413

  • octanist/tags/4.1.2/octanist.php

    r3680970 r3723184  
    33 * Plugin Name:         Octanist
    44 * Description:         First-party proxy for the Octanist pixel. Serves the tracking script, forwards events and call-tracking assignments, and captures form submissions server-side from popular form plugins.
    5  * Version:             4.1.1
     5 * Version:             4.1.2
    66 * Author:              Octanist
    77 * Author URI:          https://www.octanist.com/
    … …  
    1717}
    1818
    19 define('OCTANIST_VERSION', '4.1.1');
     19define('OCTANIST_VERSION', '4.1.2');
    2020define('OCTANIST_PATH', plugin_dir_path(__FILE__));
    2121define('OCTANIST_URL', plugin_dir_url(__FILE__));

  • octanist/tags/4.1.2/readme.txt

    r3680970 r3723184  
    44Requires at least: 6.0
    55Tested up to: 7.1
    6 Stable tag: 4.1.1
     6Stable tag: 4.1.2
    77License: GPLv2 or later
    88License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    6363== Changelog ==
    6464
     65= 4.1.2 =
     66*   **FIX:** Form capture accepts only valid Octanist session and client IDs, so oversized values sent with a form submission can no longer slow down the site.
     67
    6568= 4.1.1 =
    6669*   **FIX:** The pixel endpoint downloads the tracking script immediately when the local cache is empty, instead of waiting for WP-Cron.

  • octanist/trunk/README.md

    r3680970 r3723184  
    55**Requires at least:** 6.0
    66**Tested up to:** 7.1
    7 **Stable tag:** 4.1.1
     7**Stable tag:** 4.1.2
    88**License:** GPLv2 or later
    99**License URI:** https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4747
    4848## Changelog
     49
     50### 4.1.2
     51
     52- Form capture accepts only valid Octanist session and client IDs, so oversized values sent with a form submission can no longer slow down the site.
    4953
    5054### 4.1.1

  • octanist/trunk/includes/forms/class-octanist-form-capture.php

    r3608511 r3723184  
    8484
    8585        if (!empty($_COOKIE['octa_cid']) && is_string($_COOKIE['octa_cid'])) {
    86             $payload['cid'] = sanitize_text_field(wp_unslash($_COOKIE['octa_cid']));
     86            $cid = self::clean_id($_COOKIE['octa_cid']);
     87            if ($cid !== null) {
     88                $payload['cid'] = $cid;
     89            }
    8790        }
    8891
    … …  
    392395    private static function clean_sid(string $sid): ?string
    393396    {
    394         $sid = sanitize_text_field(wp_unslash($sid));
    395         $sid = trim($sid);
    396         return $sid === '' ? null : $sid;
     397        return self::clean_id($sid);
     398    }
     399
     400    /**
     401     * Session and client ids from the pixel are UUIDs. They arrive from anyone who submits
     402     * a form, so anything that is not a short plain id is dropped here, before
     403     * sanitize_text_field, which slows down sharply on long crafted input.
     404     */
     405    private static function clean_id(string $value): ?string
     406    {
     407        $value = trim(wp_unslash($value));
     408        if ($value === '' || strlen($value) > 128 || !preg_match('/^[A-Za-z0-9._-]+$/', $value)) {
     409            return null;
     410        }
     411        return $value;
    397412    }
    398413

  • octanist/trunk/octanist.php

    r3680970 r3723184  
    33 * Plugin Name:         Octanist
    44 * Description:         First-party proxy for the Octanist pixel. Serves the tracking script, forwards events and call-tracking assignments, and captures form submissions server-side from popular form plugins.
    5  * Version:             4.1.1
     5 * Version:             4.1.2
    66 * Author:              Octanist
    77 * Author URI:          https://www.octanist.com/
    … …  
    1717}
    1818
    19 define('OCTANIST_VERSION', '4.1.1');
     19define('OCTANIST_VERSION', '4.1.2');
    2020define('OCTANIST_PATH', plugin_dir_path(__FILE__));
    2121define('OCTANIST_URL', plugin_dir_url(__FILE__));

  • octanist/trunk/readme.txt

    r3680970 r3723184  
    44Requires at least: 6.0
    55Tested up to: 7.1
    6 Stable tag: 4.1.1
     6Stable tag: 4.1.2
    77License: GPLv2 or later
    88License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    6363== Changelog ==
    6464
     65= 4.1.2 =
     66*   **FIX:** Form capture accepts only valid Octanist session and client IDs, so oversized values sent with a form submission can no longer slow down the site.
     67
    6568= 4.1.1 =
    6669*   **FIX:** The pixel endpoint downloads the tracking script immediately when the local cache is empty, instead of waiting for WP-Cron.
Note: See TracChangeset for help on using the changeset viewer.