Skip to content

Elements: Guard against non-string className in render filter#12028

Open
aaronrobertshaw wants to merge 1 commit into
WordPress:trunkfrom
aaronrobertshaw:fix/elements-classname-type-guard
Open

Elements: Guard against non-string className in render filter#12028
aaronrobertshaw wants to merge 1 commit into
WordPress:trunkfrom
aaronrobertshaw:fix/elements-classname-type-guard

Conversation

@aaronrobertshaw
Copy link
Copy Markdown

Trac ticket: https://core.trac.wordpress.org/ticket/65379

This PR brings the changes from the following Gutenberg PR to core:

WordPress/gutenberg#78841

Description

Hardens the elements block support render filter against invalid block attribute data.

wp_render_elements_class_name() currently reads attrs.className and passes it into preg_match(). While className is expected to be a string, malformed or corrupted stored block data can contain other types (for example, an array), which can trigger a fatal TypeError in PHP 8+.

This backport adds a defensive type check so that when className is not a string, the function returns the original block content unchanged instead of attempting regex matching.

A regression test is also added to ensure non-string className values do not cause fatals and continue to fail gracefully.

Testing

• Run the PHPUnit tests for elements block support: wpRenderElementsSupport.php
• Verify the new regression test passes: test_elements_block_support_class_with_non_string_class_name
• Verify existing tests in the same file continue to pass.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props aaronrobertshaw.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

Copy link
Copy Markdown
Contributor

@andrewserong andrewserong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This defensive check makes good sense to me, the added test looks good and is passing for me locally.

LGTM 🚀

Comment on lines +112 to +117
* @ticket 65379
*
* Block attributes such as `className` are always expected to be strings,
* however invalid stored data can result in other types being present. The
* render filter should fail gracefully rather than passing an array to
* `preg_match()`.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* @ticket 65379
*
* Block attributes such as `className` are always expected to be strings,
* however invalid stored data can result in other types being present. The
* render filter should fail gracefully rather than passing an array to
* `preg_match()`.
* Block attributes such as `className` are always expected to be strings,
* however invalid stored data can result in other types being present. The
* render filter should fail gracefully rather than passing an array to
* `preg_match()`.
*
* @ticket 65379

Nit-pick

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants