Changeset 56115

Timestamp:

06/29/2023 11:25:38 PM (19 months ago)

Author:

johnbillion

Message:

General: Ignore invalid types for the '_wp_http_referer' URL query variable.

It's expected that this query variable contains a string when it's set, but it's possible for its type to be something else such as an array. Ignoring non-string values prevents cascading errors when its value is passed through functions that expect a string.

Props xknown, costdev, jrf, azaozz

Fixes #57670

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (2 diffs)
• tests/phpunit/tests/functions/referer.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -1977 +1977 @@
 
 /**
- * Retrieves unvalidated referer from '_wp_http_referer' or HTTP referer.
+ * Retrieves unvalidated referer from the '_wp_http_referer' URL query variable or the HTTP referer.
+ *
+ * If the value of the '_wp_http_referer' URL query variable is not a string then it will be ignored.
  *
  * Do not use for redirects, use wp_get_referer() instead.
@@ -1986 +1988 @@
  */
 function wp_get_raw_referer() {
-    if ( ! empty( $_REQUEST['_wp_http_referer'] ) ) {
+    if ( ! empty( $_REQUEST['_wp_http_referer'] ) && is_string( $_REQUEST['_wp_http_referer'] ) ) {
         return wp_unslash( $_REQUEST['_wp_http_referer'] );
     } elseif ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {

trunk/tests/phpunit/tests/functions/referer.php

@@ -157 +157 @@
         $this->assertSame( 'http://foo.bar/baz', wp_get_raw_referer() );
     }
+
+    /**
+     * @ticket 57670
+     */
+    public function test_raw_referer_is_false_on_invalid_request_parameter() {
+        $_REQUEST['_wp_http_referer'] = array( 'demo' );
+        $this->assertFalse( wp_get_raw_referer() );
+    }
 }