Skip to content

Fix rest_is_integer validation logic#11883

Open
coderGtm wants to merge 4 commits into
WordPress:trunkfrom
coderGtm:fix/rest-is-integer-validation
Open

Fix rest_is_integer validation logic#11883
coderGtm wants to merge 4 commits into
WordPress:trunkfrom
coderGtm:fix/rest-is-integer-validation

Conversation

@coderGtm
Copy link
Copy Markdown

This changeset updates rest_is_integer() to avoid using floating-point conversion when determining whether a value is integer-like.

Previously, the function relied on:

round( (float) $maybe_integer ) === (float) $maybe_integer

This approach breaks for large integers because PHP floating-point values cannot precisely represent all integers above IEEE-754 precision limits (~2^53). As a result, valid large integer values — including values still valid for MySQL/MariaDB BIGINT UNSIGNED columns — could incorrectly fail REST API validation.

The updated implementation:

  • avoids float conversion entirely
  • validates integer-like values using string pattern matching
  • preserves support for signed numeric strings
  • rejects decimal and scientific-notation values
  • avoids platform integer size limitations (PHP_INT_MAX)

This fixes cases where very large post IDs can cause REST API requests to fail, which may prevent the block editor from loading posts correctly when auto-increment values have been manually increased or otherwise become unusually large.

Trac ticket: https://core.trac.wordpress.org/ticket/65271

Use of AI Tools

AI assistance: Yes
Tool(s): ChatGPT
Model(s): GPT-5.5
Used for: Generating regex pattern


This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 20, 2026

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props gautam23, westonruter, siliconforks.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@github-actions
Copy link
Copy Markdown

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

$integer_pattern = '/^[+-]?\d+$/';
$scientific_pattern = '/^[+-]?\d+e\+?\d+$/i';

$value = trim( (string) $maybe_integer );
Copy link
Copy Markdown
Member

@westonruter westonruter May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Author

@coderGtm coderGtm May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch! I fixed it.

@siliconforks
Copy link
Copy Markdown

The problem with this PR is that there's a bunch of cases where it doesn't return the same result as the old implementation.

Here is what the old implementation does:

$ wp eval 'var_dump( rest_is_integer( true ) );'
bool(false)
$ wp eval 'var_dump( rest_is_integer( "123.0" ) );'
bool(true)
$ wp eval 'var_dump( rest_is_integer( "10e-1" ) );'
bool(true)

Here is what the implementation in this PR does:

$ wp eval 'var_dump( rest_is_integer( true ) );'
bool(true)
$ wp eval 'var_dump( rest_is_integer( "123.0" ) );'
bool(false)
$ wp eval 'var_dump( rest_is_integer( "10e-1" ) );'
bool(false)

I don't think we should be trying to rewrite the entire rest_is_integer implementation from scratch - even for a simple function like rest_is_integer, there are a lot of different cases to consider, and there's going to be some risk that the new implemention behaves differently from the original.

My PR (#11893) aims to fix the bug with large integers but otherwise attempts to preserve the existing behavior of the function. I think this is the safest approach.

@coderGtm
Copy link
Copy Markdown
Author

@siliconforks I fixed the boolean case. I am still not sure why would someone need 123.0 or 10e-1 as an integer here, considering its purpose. I'd even go as far as to say that this is an unnoticed bug that slipped under eyeballs for years and must be corrected now.

But even if it is needed, I would still prefer a regex based approach over a float approach. But that could be just me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants