Deprecate auto sanitize of API parameters & Common::getRequestVar and introduce Request class (#19624)

* Introduce new API property to disable autosanitizing

* Adds new getRequestParam method to replace getRequestVar somewhen

* use new method in some places

* Introduce new request class instead of Common::getRequestParam

* Improve Request class and add tests

* Adds changelog

* clean up api proxy

* code improvements

* Added doc blocks

* filter null byte values

* update tests

* update changelog

2 files changed, 15 insertions, 12 deletions

diff --git a/plugins/CoreAdminHome/Controller.php b/plugins/CoreAdminHome/Controller.php
index 4af369a7ae..cf1ce5fb70 100644
--- a/plugins/CoreAdminHome/Controller.php
+++ b/plugins/CoreAdminHome/Controller.php
@@ -25,6 +25,7 @@ use Piwik\Plugins\CustomVariables\CustomVariables;
 use Piwik\Plugins\LanguagesManager\LanguagesManager;
 use Piwik\Plugins\PrivacyManager\DoNotTrackHeaderChecker;
 use Piwik\Plugins\SitesManager\API as APISitesManager;
+use Piwik\Request;
 use Piwik\Site;
 use Piwik\Translation\Translator;
 use Piwik\Url;
@@ -154,20 +155,21 @@ class Controller extends ControllerAdmin
             $this->checkTokenInUrl();
 
             // Update email settings
-            $mail = array();
-            $mail['transport'] = (Common::getRequestVar('mailUseSmtp') == '1') ? 'smtp' : '';
-            $mail['port'] = Common::getRequestVar('mailPort', '');
-            $mail['host'] = Common::unsanitizeInputValue(Common::getRequestVar('mailHost', ''));
-            $mail['type'] = Common::getRequestVar('mailType', '');
-            $mail['username'] = Common::unsanitizeInputValue(Common::getRequestVar('mailUsername', ''));
-            $mail['password'] = Common::unsanitizeInputValue(Common::getRequestVar('mailPassword', ''));
+            $request = Request::fromRequest();
+            $mail = [];
+            $mail['transport'] = $request->getBoolParameter('mailUseSmtp') ? 'smtp' : '';
+            $mail['port'] = $request->getStringParameter('mailPort', '');
+            $mail['host'] = $request->getStringParameter('mailHost', '');
+            $mail['type'] = $request->getStringParameter('mailType', '');
+            $mail['username'] = $request->getStringParameter('mailUsername', '');
+            $mail['password'] = $request->getStringParameter('mailPassword', '');
 
             if (!array_key_exists('mailPassword', $_POST) && Config::getInstance()->mail['host'] === $mail['host']) {
                 // use old password if it wasn't set in request (and the host wasn't changed)
                 $mail['password'] = Config::getInstance()->mail['password'];
             }
 
-            $mail['encryption'] = Common::getRequestVar('mailEncryption', '');
+            $mail['encryption'] =  $request->getStringParameter('mailEncryption', '');
 
             Config::getInstance()->mail = $mail;
 
diff --git a/plugins/CoreAdminHome/OptOutManager.php b/plugins/CoreAdminHome/OptOutManager.php
index 927e3ad630..90c0b66943 100644
--- a/plugins/CoreAdminHome/OptOutManager.php
+++ b/plugins/CoreAdminHome/OptOutManager.php
@@ -14,6 +14,7 @@ use Piwik\Piwik;
 use Piwik\Plugins\LanguagesManager\API as APILanguagesManager;
 use Piwik\Plugins\LanguagesManager\LanguagesManager;
 use Piwik\Plugins\PrivacyManager\DoNotTrackHeaderChecker;
+use Piwik\Request;
 use Piwik\Tracker\IgnoreCookie;
 use Piwik\Url;
 use Piwik\View;
@@ -609,10 +610,10 @@ JS;
     private function optOutStyling(?string $fontSize = null, ?string $fontColor = null, ?string $fontFamily = null,
                                    ?string $backgroundColor = null, bool $noBody = false): string
     {
-        $cssfontsize = ($fontSize ? : Common::unsanitizeInputValue(Common::getRequestVar('fontSize', false, 'string')));
-        $cssfontcolour = ($fontColor ? : Common::unsanitizeInputValue(Common::getRequestVar('fontColor', false, 'string')));
-        $cssfontfamily = ($fontFamily ? : Common::unsanitizeInputValue(Common::getRequestVar('fontFamily', false, 'string')));
-        $cssbackgroundcolor = ($backgroundColor ? : Common::unsanitizeInputValue(Common::getRequestVar('backgroundColor', false, 'string')));
+        $cssfontsize = ($fontSize ? : Request::fromRequest()->getStringParameter('fontSize', ''));
+        $cssfontcolour = ($fontColor ? : Request::fromRequest()->getStringParameter('fontColor', ''));
+        $cssfontfamily = ($fontFamily ? : Request::fromRequest()->getStringParameter('fontFamily', ''));
+        $cssbackgroundcolor = ($backgroundColor ? : Request::fromRequest()->getStringParameter('backgroundColor', ''));
 
         if (!$noBody) {
             $cssbody = 'body { ';