AC-10541 - Web API Fix

Author: pawan-adobe-security

app/code/Magento/Webapi/Controller/Rest/InputParamsResolver.php

@@ -141,11 +141,32 @@ public function getInputData()
         } else {
             $inputData = $this->request->getRequestData();
         }
+        $this->filterInputData($inputData);
         $this->validateParameters($serviceClassName, $serviceMethodName, array_keys($route->getParameters()));
 
         return $this->paramsOverrider->override($inputData, $route->getParameters());
     }
 
+    /**
+     * Validates InputData
+     *
+     * @param array $inputData
+     * @return array
+     */
+    private function filterInputData(array $inputData): array
+    {
+        $result = [];
+
+        $data = array_filter($inputData, function ($k) use (&$result) {
+            $key = is_string($k) ? strtolower(str_replace('_', "", $k)) : $k;
+            return !isset($result[$key]) && ($result[$key] = true);
+        }, ARRAY_FILTER_USE_KEY);
+
+        return array_map(function ($value) {
+            return is_array($value) ? $this->filterInputData($value) : $value;
+        }, $data);
+    }
+
     /**
      * Retrieve current route.
      *

app/code/Magento/Webapi/Controller/Rest/ParamsOverrider.php

@@ -76,26 +76,6 @@ public function override(array $inputData, array $parameters)
         return $inputData;
     }
 
-    /**
-     * Validates InputData
-     *
-     * @param array $inputData
-     * @return array
-     */
-    private function validateInputData(array $inputData): array
-    {
-        $result = [];
-
-        $data = array_filter($inputData, function ($k) use (&$result) {
-            $key = is_string($k) ? strtolower(str_replace('_', "", $k)) : $k;
-            return !isset($result[$key]) && ($result[$key] = true);
-        }, ARRAY_FILTER_USE_KEY);
-
-        return array_map(function ($value) {
-            return is_array($value) ? $this->validateInputData($value) : $value;
-        }, $data);
-    }
-
     /**
      * Determine if a nested array value is set.
      *