WP Manifestindependent plugin directory
manifest / ecommerce / woographql-product-bundles

WooGraphQL Product Bundles WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Add WooCommerce Product Bundle support to your WPGraphQL schema

by Jacob Arriola · github.com/jacobarriola/woographql-product-bundles · website

★ 10stars
595composer installs
0.0.4latest · never

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jacobarriola/woographql-product-bundles/archive/refs/heads/master.zip

On Packagist as jacobarriola/woographql-product-bundles:

composer require jacobarriola/woographql-product-bundles
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/jacobarriola/woographql-product-bundles ↗

Add WooCommerce Product Bundle support to your WPGraphQL schema.

Requirements

  • PHP +7.1
  • WordPress +5.0
  • WPGraphQL +1
  • WooGraphQL +0.8.0
  • WooCommerce +4.7.0
  • WooCommerce Product Bundles +0.5.0

Documentation

Add To Cart Mutation

For now, add to cart is a different mutation since additional data is required. The mutation mimics the existing WooGraphQL addToCart, with a few differences.

Essentially it attempts to mimic the underlying Product Bundles' API, which is found https://docs.woocommerce.com/document/bundles/bundles-functions-reference/#add_bundle_to_cart

mutation addToCartBundle(input: { clientMutationId: "123" quantity: 1 productId: 456789 extraData
: SEE_BELOW
 } ) {
    ...
}

The extraData input is a JSON value.

Arguments
  • object index: The bundle item ID
  • product_id: Product ID of the bundled item
  • quantity: Quantity of the bundled item
  • variation_id: The variation ID of the selected variation, if applicable
  • attributes: An object with the key as attribute_ATTRIBUTE_SLUG and the value as the attribute value, if applicable

Example:

{
  "765": {
    "product_id": "9876",
    "quantity": "1",
    "optional_selected": "yes",
    "variation_id": "4321",
    "attributes": {
      "attribute_pa_color": "red",
      "attribute_pa_size": "2xl"
    } 
  },
  "896": {
    "product_id": "1234",
    "quantity": "1"
  }
}

In this example, the Bundle contains two Bundle Items, 765 and 896. 765 is a variable product (designated by the product_id: 9876). The variation_id and attributes are required . On the other hand, 896 is a simple product. It's only passing in the product_id.

Todo

  • return appropriate types instead of JSON for allowedVariations and defaultVariationAttributes
  • simplify the addToCartBundle or merge it with the core addToCart mutation

Releases

4 releases.

Tag
Published
0.0.4 latest
Apr 24, 2021 5 years ago
0.0.3
Apr 13, 2021 5 years ago
0.0.2
Mar 16, 2021 5 years ago
0.0.1
Nov 7, 2020 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

WooGraphQL Product Bundles 0.0.3 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.0.3
Findings
1
Worst severity
high
Content hash
d20aef8393c190c0dfe486f3…

Findings

  • high GraphQL extraData is passed as Product Bundles configuration, allowing discount overrides

    unsafe_input

    addToCartProductBundle is registered with register_graphql_mutation and no isPrivate/auth callback, so WPGraphQL executes it for guests and any logged-in role. After Cart_Mutation::check_session_token() (session load, not a capability check) and a wc_get_product() existence check, extraData is json_decode()d with assoc=true and passed as the third argument ($configuration) to WC_PB()->cart->add_bundle_to_cart(). That method is Product Bundles' trusted PHP cart API. WooCommerce documents that a configuration row may include discount (float, 'overrides the original bundled item meta value' when Priced Individually is on) and title. The plugin never allowlists keys to the customer-safe set (product_id, quantity, variation_id, attributes, optional_selected) that the Store API uses. A guest can therefore POST extraData such as {"765":{"product_id":"9876","quantity":"1","discount":100}} for a priced-individually bundled item and have WC_PB stamp a 100% discount into the cart session; checkout then charges the reduced line total. This is not core WooGraphQL addToCart extraData (cart_item_data); it is a privileged configuration channel this extension uniquely exposes. Last upstream commit is April 2021.

    includes/Mutation/ProductBundleAddToCart.php:70-97

    Recommendation

    Treat extraData as a public Store-API-style payload, not the PHP developer configuration. After json_decode, keep only product_id, quantity, variation_id, attributes, and optional_selected; drop discount, title, priced_individually, and any other pricing/meta overrides. Enforce quantity against the bundled item's stored min/max and require product_id to match WC_PB_DB for that bundled_item_id. Prefer a typed GraphQL input object over a raw JSON string. Optionally set mutation auth so it matches WooGraphQL cart session rules only.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →