Changeset 62762

Timestamp:

07/16/2026 02:35:01 AM (4 weeks ago)

Author:

ramonopoly

Message:

REST API: Reject non-string custom CSS in the global styles controller

This commit guards validate_custom_css() against non-string input, returning a rest_custom_css_invalid_type WP_Error with a 400 status instead of a fatal.

Before, styles.css had no type constraint in the global styles request schema, so a REST consumer could PUT an array (or any non-string value). That value reached strlen() in validate_custom_css() and threw an uncaught TypeError on PHP 8+.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/12549(​https://github.com/WordPress/wordpress-develop/pull/12549)

Props andrewserong, ramonopoly.

Fixes #65640.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-global-styles-controller.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php

@@ -674 +674 @@
          *              either through a STYLE end tag or a prefix of one which might become a
          *              full end tag when combined with the contents of other styles.
+         * @since 7.1.0 Rejects non-string values with a WP_Error instead of a fatal error.
          *
          * @see WP_Customize_Custom_CSS_Setting::validate()
          *
-         * @param string $css CSS to validate.
+         * @param mixed $css CSS to validate.
          * @return true|WP_Error True if the input was validated, otherwise WP_Error.
          */
         protected function validate_custom_css( $css ) {
+                if ( ! is_string( $css ) ) {
+                        return new WP_Error(
+                                'rest_custom_css_invalid_type',
+                                __( 'CSS must be a string.' ),
+                                array( 'status' => 400 )
+                        );
+                }
+
                 $length = strlen( $css );
                 for (

trunk/tests/phpunit/tests/rest-api/rest-global-styles-controller.php

@@ -669 +669 @@
 
         /**
+         * @covers WP_REST_Global_Styles_Controller::update_item
+         * @ticket 65640
+         */
+        public function test_update_item_non_string_styles_css() {
+                wp_set_current_user( self::$admin_id );
+                if ( is_multisite() ) {
+                        grant_super_admin( self::$admin_id );
+                }
+                $request = new WP_REST_Request( 'PUT', '/wp/v2/global-styles/' . self::$global_styles_id );
+                $request->set_body_params(
+                        array(
+                                'styles' => array( 'css' => array( 'body { color: red; }' ) ),
+                        )
+                );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_custom_css_invalid_type', $response, 400 );
+        }
+
+        /**
          * Tests the submission of a custom block style variation that was defined
          * within a theme style variation and wouldn't be registered at the time
@@ -947 +966 @@
                 );
         }
+
+        /**
+         * @covers WP_REST_Global_Styles_Controller::validate_custom_css
+         * @ticket 65640
+         *
+         * @dataProvider data_custom_css_non_string
+         *
+         * @param mixed $custom_css Non-string value to validate.
+         */
+        public function test_validate_custom_css_non_string( $custom_css ) {
+                $controller = new WP_REST_Global_Styles_Controller();
+                $validate   = Closure::bind(
+                        function ( $css ) {
+                                return $this->validate_custom_css( $css );
+                        },
+                        $controller,
+                        $controller
+                );
+
+                $result = $validate( $custom_css );
+                $this->assertWPError( $result );
+                $this->assertSame( 'rest_custom_css_invalid_type', $result->get_error_code() );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<string, mixed[]>
+         */
+        public static function data_custom_css_non_string(): array {
+                return array(
+                        'array'   => array( array( 'body { color: red; }' ) ),
+                        'integer' => array( 123 ),
+                        'boolean' => array( true ),
+                        'null'    => array( null ),
+                        'object'  => array( new stdClass() ),
+                );
+        }
 }