JSON validation issue fix

Replies: 0

Hi WP Fastest Cache team!

We found issue of JSON validation inside WpFastestCacheCreateCache::is_json() method. In some cases when we build API using custom URI (e.g. http://api.host.com/somequery) we got “<!– html is corrupted –>” string injection before output buffer. This issue refer to file %wp_root%/wp-content/plugins/wp-fastest-cache/inc/cache.php (line 524).

Please find below our implementation for is_json() method which fix issue.

                public function is_json($buffer){
                        @json_decode($buffer);
                        return (json_last_error() === JSON_ERROR_NONE);
                }

The key idea in checking whole output buffer (fastest way) and if buffer is a json string then return true. This fix will cover all cases with json buffer.

Please find below our patch file plugin_wp-fastest-cache_is_json_fix.patch:

diff --git a/www/wp-content/plugins/wp-fastest-cache/inc/cache.php b/www/wp-content/plugins/wp-fastest-cache/inc/cache.php
index 856c1c7..9b08ef3 100644
--- a/www/wp-content/plugins/wp-fastest-cache/inc/cache.php
+++ b/www/wp-content/plugins/wp-fastest-cache/inc/cache.php
@@ -522,23 +522,8 @@
 		}
 
 		public function is_json($buffer){
-			if(isset($_SERVER["HTTP_ACCEPT"]) && preg_match("/json/i", $_SERVER["HTTP_ACCEPT"])){
-				return true;
-			}
-
-			if(preg_match("/^\/wp-json/", $_SERVER["REQUEST_URI"])){
-				return true;
-			}
-
-			if(preg_match("/^\s*\{\s*[\"\']/i", $buffer)){
-				return true;
-			}
-
-			if(preg_match("/^\s*\[\s*\{\s*[\"\']/i", $buffer)){
-				return true;
-			}
-
-			return false;
+                        @json_decode($buffer);
+                        return (json_last_error() === JSON_ERROR_NONE);
 		}
 
 		public function is_xml($buffer){
@@ -1087,4 +1072,4 @@
 			return false;
 		}
 	}
-?>
\ No newline at end of file
+?>

Best regards,
Alex