REST API: fix object/array validation for JSON strings in GET requestsThis commit aligns GET parameter handling with POST requests by allowingJSON-encoded strings to pass 'object' and 'array' validation andsanitization.- Added JSON coercion in rest_validate_value_from_schema().- Added JSON coercion in rest_sanitize_value_from_schema().- Supports multi-type schemas and uses json_last_error() for safety.Fixes #64926

Author: liaisontw

src/wp-includes/rest-api.php

@@ -2182,6 +2182,25 @@ function rest_get_allowed_schema_keywords() {
  * @return true|WP_Error
  */
 function rest_validate_value_from_schema( $value, $args, $param = '' ) {
+	// Ensure GET requests can handle JSON-encoded objects/arrays, 
+	// aligning with POST body parsing.
+    $type = isset( $args['type'] ) ? $args['type'] : '';
+
+    $is_structured = ( 'object' === $type || 'array' === $type );
+    if ( ! $is_structured && is_array( $type ) ) {
+        $is_structured = in_array( 'object', $type, true ) || in_array( 'array', $type, true );
+    }
+
+	if ( is_string( $value ) && $is_structured ) {
+		$decoded = json_decode( $value, true );
+
+		// Verify it's valid JSON and not just a string that looks like one.
+		if ( json_last_error() === JSON_ERROR_NONE ) {
+			// Additional safety: ensure null values or empty arrays are handled correctly.
+			$value = $decoded;
+		}
+	}
+
 	if ( isset( $args['anyOf'] ) ) {
 		$matching_schema = rest_find_any_matching_schema( $value, $args, $param );
 		if ( is_wp_error( $matching_schema ) ) {
@@ -2780,6 +2799,25 @@ function rest_validate_integer_value_from_schema( $value, $args, $param ) {
  * @return mixed|WP_Error The sanitized value or a WP_Error instance if the value cannot be safely sanitized.
  */
 function rest_sanitize_value_from_schema( $value, $args, $param = '' ) {
+	// Ensure GET requests can handle JSON-encoded objects/arrays, 
+	//aligning with POST body parsing.
+    $type = isset( $args['type'] ) ? $args['type'] : '';
+
+    $is_structured = ( 'object' === $type || 'array' === $type );
+    if ( ! $is_structured && is_array( $type ) ) {
+        $is_structured = in_array( 'object', $type, true ) || in_array( 'array', $type, true );
+    }
+
+    if ( is_string( $value ) && $is_structured ) {
+		$decoded = json_decode( $value, true );
+
+		// Verify it's valid JSON and not just a string that looks like one.
+		if ( json_last_error() === JSON_ERROR_NONE ) {
+			// Additional safety: ensure null values or empty arrays are handled correctly.
+			$value = $decoded;
+		}
+	}
+
 	if ( isset( $args['anyOf'] ) ) {
 		$matching_schema = rest_find_any_matching_schema( $value, $args, $param );
 		if ( is_wp_error( $matching_schema ) ) {