From 72abe7a2a4fca008ef6d06cd5c546bed32a1a64b Mon Sep 17 00:00:00 2001 From: Aman Awasthi <132903744+amanawasthi2025@users.noreply.github.com> Date: Tue, 4 Aug 2026 02:18:38 +0530 Subject: [PATCH] XML-RPC: Return an error when a comment field exceeds the maximum length. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment form (`wp_handle_comment_submission()`) and the REST API comments controller both validate comment fields against `wp_check_comment_data_max_lengths()` before inserting, but the XML-RPC `wp.newComment` path never called the validator, so over-long fields were silently truncated at the database layer instead of the client receiving an error. Validate the fully assembled comment in `wp_xmlrpc_server::wp_newComment()` — covering both the logged-in and anonymous flows — and return an `IXR_Error` 413, reusing the REST API's existing error string. Includes tests for each over-long field (author, author email, author URL, content) in both flows, plus an at-the-limit acceptance case. Fixes #38622. Co-Authored-By: Claude Fable 5 --- src/wp-includes/class-wp-xmlrpc-server.php | 7 ++ tests/phpunit/tests/xmlrpc/wp/newComment.php | 103 +++++++++++++++++++ 2 files changed, 110 insertions(+) diff --git a/src/wp-includes/class-wp-xmlrpc-server.php b/src/wp-includes/class-wp-xmlrpc-server.php index 7d64d3f46c019..6d83f3fed3799 100644 --- a/src/wp-includes/class-wp-xmlrpc-server.php +++ b/src/wp-includes/class-wp-xmlrpc-server.php @@ -3902,6 +3902,7 @@ public function wp_editComment( $args ) { * Creates a new comment. * * @since 2.7.0 + * @since 7.2.0 Returns an error if a comment field exceeds its maximum length. * * @param array $args { * Method arguments. Note: arguments must be ordered as documented. @@ -4028,6 +4029,12 @@ public function wp_newComment( $args ) { return new IXR_Error( 403, __( 'Comment is required.' ) ); } + $check_max_lengths = wp_check_comment_data_max_lengths( $comment ); + + if ( is_wp_error( $check_max_lengths ) ) { + return new IXR_Error( 413, __( 'Comment field exceeds maximum length allowed.' ) ); + } + /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.newComment', $args, $this ); diff --git a/tests/phpunit/tests/xmlrpc/wp/newComment.php b/tests/phpunit/tests/xmlrpc/wp/newComment.php index 00b0617f53839..c1c76e44cf028 100644 --- a/tests/phpunit/tests/xmlrpc/wp/newComment.php +++ b/tests/phpunit/tests/xmlrpc/wp/newComment.php @@ -389,4 +389,107 @@ public function data_comments_observe_post_permissions() { ), ); } + + /** + * Ensure an error is returned when a comment field exceeds its maximum length. + * + * @ticket 38622 + * + * @dataProvider data_new_comment_with_field_exceeding_max_length + * + * @param array $content_struct Content struct with one field exceeding its maximum length. + */ + public function test_new_comment_with_field_exceeding_max_length( $content_struct ) { + add_filter( 'xmlrpc_allow_anonymous_comments', '__return_true' ); + + $result = $this->myxmlrpcserver->wp_newComment( + array( + 1, + '', + '', + self::$posts['publish']->ID, + $content_struct, + ) + ); + + $this->assertIXRError( $result ); + $this->assertSame( 413, $result->code ); + } + + /** + * Data provider for test_new_comment_with_field_exceeding_max_length. + * + * @return array[] + */ + public function data_new_comment_with_field_exceeding_max_length() { + $defaults = array( + 'author' => 'WordPress', + 'author_email' => 'noreply@wordpress.org', + 'content' => 'Test Comment', + ); + + return array( + 'author of 246 characters' => array( + array_merge( $defaults, array( 'author' => str_repeat( 'a', 246 ) ) ), + ), + 'author email of 101 characters' => array( + array_merge( $defaults, array( 'author_email' => str_repeat( 'a', 89 ) . '@example.com' ) ), + ), + 'author URL of 201 characters' => array( + array_merge( $defaults, array( 'author_url' => 'https://example.com/' . str_repeat( 'a', 181 ) ) ), + ), + 'content of 65526 characters' => array( + array_merge( $defaults, array( 'content' => str_repeat( 'a', 65526 ) ) ), + ), + ); + } + + /** + * Ensure an error is returned when a logged-in user's comment content exceeds its maximum length. + * + * @ticket 38622 + */ + public function test_new_comment_with_content_exceeding_max_length_logged_in() { + $result = $this->myxmlrpcserver->wp_newComment( + array( + 1, + 'administrator', + 'administrator', + self::$posts['publish']->ID, + array( + 'content' => str_repeat( 'a', 65526 ), + ), + ) + ); + + $this->assertIXRError( $result ); + $this->assertSame( 413, $result->code ); + } + + /** + * Ensure a comment with all fields at their maximum length is accepted. + * + * @ticket 38622 + */ + public function test_new_comment_with_fields_at_max_length() { + add_filter( 'xmlrpc_allow_anonymous_comments', '__return_true' ); + + $result = $this->myxmlrpcserver->wp_newComment( + array( + 1, + '', + '', + self::$posts['publish']->ID, + array( + 'author' => str_repeat( 'a', 245 ), + 'author_email' => str_repeat( 'a', 88 ) . '@example.com', + 'author_url' => 'https://example.com/' . str_repeat( 'a', 180 ), + 'content' => str_repeat( 'a', 65525 ), + ), + ) + ); + + $this->assertNotIXRError( $result ); + $this->assertIsInt( $result ); + } }