Elements: Guard against non-string className in render filter#12028
Elements: Guard against non-string className in render filter#12028aaronrobertshaw wants to merge 1 commit into
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
andrewserong
left a comment
There was a problem hiding this comment.
This defensive check makes good sense to me, the added test looks good and is passing for me locally.
LGTM 🚀
| * @ticket 65379 | ||
| * | ||
| * Block attributes such as `className` are always expected to be strings, | ||
| * however invalid stored data can result in other types being present. The | ||
| * render filter should fail gracefully rather than passing an array to | ||
| * `preg_match()`. |
There was a problem hiding this comment.
| * @ticket 65379 | |
| * | |
| * Block attributes such as `className` are always expected to be strings, | |
| * however invalid stored data can result in other types being present. The | |
| * render filter should fail gracefully rather than passing an array to | |
| * `preg_match()`. | |
| * Block attributes such as `className` are always expected to be strings, | |
| * however invalid stored data can result in other types being present. The | |
| * render filter should fail gracefully rather than passing an array to | |
| * `preg_match()`. | |
| * | |
| * @ticket 65379 |
Nit-pick
Trac ticket: https://core.trac.wordpress.org/ticket/65379
This PR brings the changes from the following Gutenberg PR to core:
WordPress/gutenberg#78841
Description
Hardens the elements block support render filter against invalid block attribute data.
wp_render_elements_class_name()currently readsattrs.classNameand passes it intopreg_match(). WhileclassNameis expected to be astring, malformed or corrupted stored block data can contain other types (for example, anarray), which can trigger a fatalTypeErrorin PHP 8+.This backport adds a defensive type check so that when
classNameis not a string, the function returns the original block content unchanged instead of attempting regex matching.A regression test is also added to ensure non-string
classNamevalues do not cause fatals and continue to fail gracefully.Testing
• Run the PHPUnit tests for elements block support:
wpRenderElementsSupport.php• Verify the new regression test passes:
test_elements_block_support_class_with_non_string_class_name• Verify existing tests in the same file continue to pass.