fix: sanitize GET params and add null checks in REST API association endpoints

[thisismyurl]

Summary

Adds missing input sanitization and null checks to REST API association endpoints, preventing unsanitized user input from reaching database operations.

Problem

The REST API endpoints for get_association_data() and get_association_options() in core/REST_API/Router.php were directly accessing $_GET['container_id'], $_GET['field_id'], and $_GET['options'] without sanitization or null checks. While the rest of the codebase properly sanitizes these parameters (see lines 367–368), these two methods were overlooked.

This creates a potential security issue where unsanitized user input could reach database queries if not sanitized at the query layer.

Solution

Added proper input validation to both methods:

// Before (lines 324–325)
$container_id = $_GET['container_id'];
$field_id     = $_GET['field_id'];

// After
$container_id = isset( $_GET['container_id'] ) ? sanitize_text_field( $_GET['container_id'] ) : '';
$field_id     = isset( $_GET['field_id'] ) ? sanitize_text_field( $_GET['field_id'] ) : '';

if ( ! $container_id || ! $field_id ) {
    return $return_value;
}

Same pattern applied to get_association_options() and the options parameter before it's used in explode(). This matches the existing sanitization pattern already in use elsewhere in the same file.

Changes

• Added isset() checks to prevent undefined index notices
• Applied sanitize_text_field() to string inputs
• Added early returns when required parameters are empty
• Follows the existing sanitization pattern in the Router class (lines 367–368)

All changes are backwards compatible and defensive in nature.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Hardens REST router endpoints by sanitizing query parameters and avoiding undefined index notices when required params are missing.

Changes:

• Sanitize container_id, field_id, and options inputs read from $_GET
• Add early returns when required parameters are missing (returning empty arrays)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.