Changeset 53818 for trunk/src/wp-includes/class-wp-object-cache.php

Timestamp:

08/03/2022 02:34:58 PM (4 years ago)

Author:

SergeyBiryukov

Message:

Cache API: Validate cache key in WP_Object_Cache methods.

Some plugins may call the wp_cache_*() functions with an empty string, false, or null as cache key, usually as a result of not checking the return value of another function that's used as the key.

Previously, this was silently failing, leading to odd behavior at best and often breakage due to key collisions.

A valid cache key must be either an integer number or a non-empty string.

This commit introduces a quick type check on the given cache keys and adds a _doing_it_wrong() message that should help plugin developers to notice these issues quicker.

Includes:

• A check in update_user_caches() and clean_user_cache() to make sure user email is not empty before being cached or removed from cache, as it is technically possible to create a user with empty email via wp_insert_user().
• Some minor cleanup in unit tests where the email was passed to wp_insert_user() incorrectly or was unintentionally reset.

Props tillkruess, malthert, dd32, spacedmonkey, flixos90, peterwilsoncc, SergeyBiryukov.
Fixes #56198.

File:

• trunk/src/wp-includes/class-wp-object-cache.php (modified) (9 diffs)

trunk/src/wp-includes/class-wp-object-cache.php

@@ -131 +131 @@
 
         /**
+         * Serves as a utility function to determine whether a key is valid.
+         *
+         * @since 6.1.0
+         *
+         * @param int|string $key Cache key to check for validity.
+         * @return bool Whether the key is valid.
+         */
+        protected function is_valid_key( $key ) {
+                if ( is_int( $key ) ) {
+                        return true;
+                }
+
+                if ( is_string( $key ) && trim( $key ) !== '' ) {
+                        return true;
+                }
+
+                $type = gettype( $key );
+
+                if ( ! function_exists( '__' ) ) {
+                        wp_load_translations_early();
+                }
+
+                $message = is_string( $key )
+                        ? __( 'Cache key must not be an empty string.' )
+                        /* translators: %s: The type of the given cache key. */
+                        : sprintf( __( 'Cache key must be integer or non-empty string, %s given.' ), $type );
+
+                _doing_it_wrong(
+                        sprintf( '%s::%s', __CLASS__, debug_backtrace( DEBUG_BACKTRACE_IGNORE_ARGS, 2 )[1]['function'] ),
+                        $message,
+                        '6.1.0'
+                );
+
+                return false;
+        }
+
+        /**
          * Serves as a utility function to determine whether a key exists in the cache.
          *
@@ -164 +201 @@
                 }
 
+                if ( ! $this->is_valid_key( $key ) ) {
+                        return false;
+                }
+
                 if ( empty( $group ) ) {
                         $group = 'default';
@@ -217 +258 @@
          */
         public function replace( $key, $data, $group = 'default', $expire = 0 ) {
+                if ( ! $this->is_valid_key( $key ) ) {
+                        return false;
+                }
+
                 if ( empty( $group ) ) {
                         $group = 'default';
@@ -246 +291 @@
          *
          * @since 2.0.0
+         * @since 6.1.0 Returns false if cache key is invalid.
          *
          * @param int|string $key    What to call the contents in the cache.
@@ -251 +297 @@
          * @param string     $group  Optional. Where to group the cache contents. Default 'default'.
          * @param int        $expire Optional. Not used.
-         * @return true Always returns true.
+         * @return bool True if contents were set, false if key is invalid.
          */
         public function set( $key, $data, $group = 'default', $expire = 0 ) {
+                if ( ! $this->is_valid_key( $key ) ) {
+                        return false;
+                }
+
                 if ( empty( $group ) ) {
                         $group = 'default';
@@ -311 +361 @@
          */
         public function get( $key, $group = 'default', $force = false, &$found = null ) {
+                if ( ! $this->is_valid_key( $key ) ) {
+                        return false;
+                }
+
                 if ( empty( $group ) ) {
                         $group = 'default';
@@ -369 +423 @@
          */
         public function delete( $key, $group = 'default', $deprecated = false ) {
+                if ( ! $this->is_valid_key( $key ) ) {
+                        return false;
+                }
+
                 if ( empty( $group ) ) {
                         $group = 'default';
@@ -417 +475 @@
          */
         public function incr( $key, $offset = 1, $group = 'default' ) {
+                if ( ! $this->is_valid_key( $key ) ) {
+                        return false;
+                }
+
                 if ( empty( $group ) ) {
                         $group = 'default';
@@ -456 +518 @@
          */
         public function decr( $key, $offset = 1, $group = 'default' ) {
+                if ( ! $this->is_valid_key( $key ) ) {
+                        return false;
+                }
+
                 if ( empty( $group ) ) {
                         $group = 'default';