{"id":18742445,"date":"2025-12-04T10:43:37","date_gmt":"2025-12-04T10:43:37","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/security-issue-unsanitized-input-causes-fatal-error\/"},"modified":"2025-12-04T10:43:37","modified_gmt":"2025-12-04T10:43:37","slug":"security-issue-unsanitized-input-causes-fatal-error","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/security-issue-unsanitized-input-causes-fatal-error\/","title":{"rendered":"Security Issue &#8211; Unsanitized Input Causes Fatal Error"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hi Emili,<br \/>I discovered a security issue in DK PDF that causes fatal errors when malformed input is received in the PDF parameter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Issue<\/strong><br \/>The plugin crashes when receiving characters like backslashes or quotes in the <code>pdf<\/code> query parameter. In <code>Generator.php<\/code> line 26, <code>get_query_var('pdf')<\/code> is used directly without sanitization before being passed to <code>ContextManager::setupContext()<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Error received<\/strong><br \/>PHP Fatal error: Uncaught Exception: Unknown archive type: 391315&#8217;\\ in \/wp-content\/plugins\/dk-pdf\/modules\/PDF\/ContextManager.php:195<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The malformed parameter <code>pdf=391315\\'<\/code> causes the ContextManager to misinterpret a numeric post ID as an archive type string.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Impact<\/strong><br \/>While this appears to be caused by bots\/scanners, it exposes sites to potential DoS attacks through malformed requests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Could you provide an email address where I can send you the complete stack trace privately?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thanks for your work on this plugin!<\/p>\n","protected":false},"template":"","class_list":["post-18742445","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18742445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18742445\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18742445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}