wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php:3087Validates the sub_sizes file names against what this attachment produced.
$attachment_idint$sub_sizesarraytrue|WP_Error protected function validate_sub_size_provenance( int $attachment_id, array $sub_sizes ) { $allowed = $this->get_sideloaded_file_names( $attachment_id ); foreach ( $sub_sizes as $sub_size ) { foreach ( array( 'file', 'original_image' ) as $key ) { /* * Every value that was sent is checked, no matter how unlikely * a name it looks. A loose emptiness test would wave through * '0', which is a valid one-character name as far as the schema * is concerned and is stored like any other. A value the schema * types as a string but which arrives as something else is * rejected rather than skipped, so a subclass which widens the * schema cannot pass an unchecked value on to the metadata. */ if ( ! isset( $sub_size[ $key ] ) ) { continue; } if ( ! is_string( $sub_size[ $key ] ) || ! in_array( $sub_size[ $key ], $allowed, true ) ) { return new WP_Error( 'rest_invalid_sub_size_file', __( 'Invalid sub-size file name. File names must have been produced by a prior sideload for this attachment.' ), array( 'status' => 400 ) ); } } } return true; }Introduced in 7.1.0.
Signature, return type and hooks compared across 1 parsed release.
src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.