Changeset 62813 for trunk/src/wp-includes/functions.php

Timestamp:

07/21/2026 10:46:36 PM (39 hours ago)

Author:

westonruter

Message:

Code Quality: Ensure wp_filesize() always returns a non-negative-int.

A negative file size is clearly impossible, and the return value of 0 is already documented as being the error case.

• Values filtered by pre_wp_filesize and wp_filesize are cast to int if they are numeric.
• Non-numeric values returned by the wp_filesize filter are discarded in favor of zero.
• Negative values filtered by the pre_wp_filesize filter are treated the same as null (and do not short-circuit).
• Negative values returned by the wp_filesize filter are clamped to be at least zero.

Developed as part of ​https://github.com/WordPress/wordpress-develop/pull/12611.
Follow-up to r52837, r52932.

Props westonruter, apermo.
See #65670, #64898.

File:

• trunk/src/wp-includes/functions.php (modified) (3 diffs)

trunk/src/wp-includes/functions.php

@@ -3640 +3640 @@
  *
  * @since 6.0.0
+ * @since 7.1.0 The return value is now ensured to always be greater than or equal to zero.
  *
  * @link https://www.php.net/manual/en/function.filesize.php
@@ -3645 +3646 @@
  * @param string $path Path to the file.
  * @return int The size of the file in bytes, or 0 in the event of an error.
- */
-function wp_filesize( $path ) {
+ * @phpstan-return non-negative-int
+ */
+function wp_filesize( $path ): int {
         /**
          * Filters the result of wp_filesize() before the file_exists() PHP function is run.
          *
          * @since 6.0.0
-         *
-         * @param null|int $size The unfiltered value. Returning an int from the callback bypasses the filesize call.
+         * @since 7.1.0 Negative values are now ignored, being treated the same as null. Numeric values are cast to integers.
+         *
+         * @param null|int $size The unfiltered value. Returning a non-negative number from the callback bypasses the filesize call.
          * @param string   $path Path to the file.
          */
         $size = apply_filters( 'pre_wp_filesize', null, $path );
-
-        if ( is_int( $size ) ) {
+        if ( is_numeric( $size ) ) {
+                $size = (int) $size;
+        }
+        if ( is_int( $size ) && $size >= 0 ) {
                 return $size;
         }
@@ -3667 +3672 @@
          *
          * @since 6.0.0
+         * @since 7.1.0 The return value is now always zero or greater. Numeric values are cast to integers.
          *
          * @param int    $size The result of PHP filesize on the file.
          * @param string $path Path to the file.
          */
-        return (int) apply_filters( 'wp_filesize', $size, $path );
+        $size = apply_filters( 'wp_filesize', $size, $path );
+        if ( is_numeric( $size ) ) {
+                $size = (int) $size;
+        } else {
+                $size = 0;
+        }
+        return max( 0, $size );
 }