Changeset 48433

Timestamp:

07/11/2020 12:11:57 AM (4 years ago)

Author:

whyisjake

Message:

Formatting: Prevent wp_slash from returning non-strings as strings.

If a bool/float/int is passed into wp_slash it will be coerced into a string.

This changes the behavior to only slash strings. At the same time, handles recursion a little nicer by calling array_map for arrays.

Fixes #42195, #24106.

Props johnbillion, andizer, jrf, ryotasakamoto, SergeyBiryukov, donmhico, TobiasBg, markoheijnen, ryan, nacin, devesine, whyisjake.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (3 diffs)
• tests/phpunit/tests/formatting/StripSlashesDeep.php (modified) (1 diff)
• tests/phpunit/tests/formatting/WPSlash.php (added)

trunk/src/wp-includes/formatting.php

@@ -5497 +5497 @@
 
 /**
- * Add slashes to a string or array of strings.
+ * Add slashes to a string or array of strings, in a recursive manner.
  *
  * This should be used when preparing data for core API that expects slashed data.
@@ -5503 +5503 @@
  *
  * @since 3.6.0
+ * @since 5.5.0 Leave a non-string value untouched.
  *
  * @param string|array $value String or array of strings to slash.
@@ -5509 +5510 @@
 function wp_slash( $value ) {
     if ( is_array( $value ) ) {
-        foreach ( $value as $k => $v ) {
-            if ( is_array( $v ) ) {
-                $value[ $k ] = wp_slash( $v );
-            } else {
-                $value[ $k ] = addslashes( $v );
-            }
-        }
-    } else {
-        $value = addslashes( $value );
+        $value = array_map( 'wp_slash', $value );
+    }
+
+    if ( is_string( $value ) ) {
+        return addslashes( $value );
     }
 

trunk/tests/phpunit/tests/formatting/StripSlashesDeep.php

@@ -3 +3 @@
 /**
  * @group formatting
+ * @group slashes
  */
 class Tests_Formatting_StripSlashesDeep extends WP_UnitTestCase {