Code Quality: Account for `object` being supplied as post, term, or comment by westonruter · Pull Request #11096 · WordPress/wordpress-develop

westonruter · 2026-02-28T20:09:10Z

Trac ticket: https://core.trac.wordpress.org/ticket/64238
Trac ticket: https://core.trac.wordpress.org/ticket/64225

Ensure that ID exists on post object in get_post() and term_id exists on term object in sanitize_term().
Document that a plain object may be supplied to the WP_Comment constructor.

Use of AI Tools

See co-authored commits. Gemini CLI used to help write tests.

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

Commit Message

Code Quality: Account for object being supplied as post, term, or comment.

Ensure that ID exists on post object in get_post() and term_id exists on term object in sanitize_term().
Document that a plain object may be supplied to the WP_Comment constructor.

Developed in #11096

See #64238.

github-actions · 2026-02-28T20:09:18Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props westonruter, apermo.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-02-28T20:17:23Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

westonruter · 2026-02-28T20:19:55Z

src/wp-includes/post.php

+		} elseif ( isset( $post->ID ) ) {
 			$_post = WP_Post::get_instance( $post->ID );
+		} else {
+			$_post = null;


I guess some test coverage here would be good.

Added in 92952de

westonruter · 2026-02-28T20:20:02Z

src/wp-includes/taxonomy.php

 	$do_object = is_object( $term );

-	$term_id = $do_object ? $term->term_id : ( $term['term_id'] ?? 0 );
+	$term_id = $do_object ? ( $term->term_id ?? 0 ) : ( $term['term_id'] ?? 0 );


Test coverage here too.

Added in 3736bea

apermo · 2026-03-01T12:13:57Z

src/wp-includes/post.php

 		} elseif ( 'raw' === $post->filter ) {
 			$_post = new WP_Post( $post );
-		} else {
+		} elseif ( isset( $post->ID ) ) {


This would mean that $post is no instance of WP_Post(we're in the else of line 1154).

PHPdoc for $post says @param int|WP_Post|null $post Optional. Post ID or post object.

So if you expect this to be a generic object, that is formed like WP_Post, the PHPDoc Block is wrong.

Ah yes, the PHPDoc needs to be updated to add object as well.

Or I guess, object should be used instead of WP_Post given our other conversation.

How/why is it possible that an object that mimics WP_Post is passed here? Doesn’t look like solid architecture

It's when post data is passed straight from a database query.

Changed in d3407f2

src/wp-includes/class-wp-comment.php

Corrected formatting of the parameter description for clarity.

Adds a new test suite for get_post() to ensure complete coverage of: - Global $post retrieval with various empty-like inputs. - Different input types (ID, object, WP_Post instance). - All output formats (OBJECT, ARRAY_A, ARRAY_N). - Filter application and field sanitization. - Handling of unrecognized output types. Co-authored-by: gemini-cli <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Adds a new test suite for sanitize_term() to ensure coverage of: - Sanitizing both objects and arrays. - Handling missing term_id correctly. - Applying different sanitization contexts (raw, edit, display, attribute, js). - Verifying field sanitization results in each context. - Resolves PHPStan type-checking issues with proper assertions. Co-authored-by: gemini-cli <176961590+gemini-code-assist[bot]@users.noreply.github.com>

…into add/isset-checks

…tests Updates the example script tags in get_post() and sanitize_term() tests to use console.log(), which is a more appropriate example for modern testing. Co-authored-by: gemini-cli <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Moves the filter property assertion into the appropriate conditional blocks and removes the redundant final if statement for better code structure. Co-authored-by: gemini-cli <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Simplifies the test logic by removing an unnecessary null check, as subsequent type assertions already provide this verification. Co-authored-by: gemini-cli <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Copilot

Pull request overview

This PR improves resilience when core APIs receive plain object instances (e.g., DB row objects) that may be missing expected identifier properties, preventing PHP notices and clarifying constructor expectations in documentation.

Changes:

Update sanitize_term() to tolerate term objects missing term_id.
Update get_post() to tolerate post-like objects missing ID and return null rather than triggering a notice.
Add PHPUnit coverage for these object-input edge cases and update constructor PHPDocs for WP_Post and WP_Comment.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/phpunit/tests/term/sanitizeTerm.php	Adds tests ensuring `sanitize_term()` handles objects with/without `term_id` across contexts.
tests/phpunit/tests/post/getPost.php	Adds tests covering `get_post()` behavior for globals, IDs, WP_Post instances, and post-like objects missing `ID`.
src/wp-includes/taxonomy.php	Avoids undefined property notices by using a default `term_id` when missing on objects.
src/wp-includes/post.php	Prevents undefined property notices by checking for `ID` before calling `WP_Post::get_instance()`.
src/wp-includes/class-wp-post.php	Updates constructor PHPDoc to reflect that a generic object can be supplied.
src/wp-includes/class-wp-comment.php	Updates constructor PHPDoc to reflect that a generic object can be supplied.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…ost, site, term, and user. When constructing these objects, the specific instance type is redundantly used in a union with a generic `object`. A generic object can be passed directly from database row result. This also hardens `get_post()` to account for passing an object that lacks an `ID` property. Similarly, `sanitize_term()` is hardened to account for an object lacking a `term_id` property. Comprehensive unit tests are added for `get_post()` and `sanitize_term()`. Developed in #11096 Props westonruter, apermo. See #64238, #64225. git-svn-id: https://develop.svn.wordpress.org/trunk@61789 602fd350-edb4-49c9-b593-d223f7449a82

westonruter · 2026-03-03T05:54:33Z

Committed in r61789 (f997e86)

…ost, site, term, and user. When constructing these objects, the specific instance type is redundantly used in a union with a generic `object`. A generic object can be passed directly from database row result. This also hardens `get_post()` to account for passing an object that lacks an `ID` property. Similarly, `sanitize_term()` is hardened to account for an object lacking a `term_id` property. Comprehensive unit tests are added for `get_post()` and `sanitize_term()`. Developed in WordPress/wordpress-develop#11096 Props westonruter, apermo. See #64238, #64225. Built from https://develop.svn.wordpress.org/trunk@61789 git-svn-id: http://core.svn.wordpress.org/trunk@61095 1a063a9b-81f0-0310-95a4-ce76da25c4cd

westonruter added 3 commits February 28, 2026 12:01

Ensure term_id property exists on object

417b389

Ensure ID property exists before attempting to read it in get_post()

366a685

Indicate that WP_Comment accepts a plain object as its parameter

20cf57e

westonruter changed the title ~~Account for object being supplied as post, term, and comment~~ Code Quality: Account for object being supplied as post, term, and comment Feb 28, 2026

westonruter changed the title ~~Code Quality: Account for object being supplied as post, term, and comment~~ Code Quality: Account for object being supplied as post, term, or comment Feb 28, 2026

westonruter commented Feb 28, 2026

View reviewed changes

apermo reviewed Mar 1, 2026

View reviewed changes

westonruter commented Mar 1, 2026

View reviewed changes

src/wp-includes/class-wp-comment.php Outdated Show resolved Hide resolved

apermo approved these changes Mar 1, 2026

View reviewed changes

westonruter added 2 commits March 1, 2026 10:55

Use object instead of WP_Post in get_post()

d3407f2

Use object as arg type for WP_Comment constructor

f9e371f

westonruter commented Mar 1, 2026

View reviewed changes

src/wp-includes/class-wp-comment.php Show resolved Hide resolved

westonruter and others added 9 commits March 1, 2026 10:59

Fix parameter description formatting in post.php

917ccfc

Corrected formatting of the parameter description for clarity.

Update param type for WP_Post constructor to be just object

a0adb6a

Merge branch 'trunk' of https://github.com/WordPress/wordpress-develop …

9fc4723

…into add/isset-checks

Fix alignment of get_post() params

5fbfeed

Tests: Remove redundant assertNotNull in get_post() tests

888ba44

Simplifies the test logic by removing an unnecessary null check, as subsequent type assertions already provide this verification. Co-authored-by: gemini-cli <176961590+gemini-code-assist[bot]@users.noreply.github.com>

westonruter requested a review from Copilot March 3, 2026 00:18

Copilot started reviewing on behalf of westonruter March 3, 2026 00:19 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

westonruter added 3 commits March 2, 2026 21:16

Merge branch 'trunk' into add/isset-checks

6816649

Use generic object as param for WP_Term constructor

93006ad

Use object for WP_Site constructor

07d76fd

Simplify WP_User param type to object

2e67166

westonruter closed this Mar 3, 2026

Conversation

westonruter commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Use of AI Tools

Commit Message

Uh oh!

github-actions bot commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 28, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

westonruter commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

westonruter commented Feb 28, 2026 •

edited

Loading

github-actions bot commented Feb 28, 2026 •

edited

Loading