Changeset 64309 for trunk/src/wp-includes/class-wp-theme-json.php

Timestamp:

10/12/2026 08:18:48 AM (33 hours ago)

Author:

ramonopoly

Message:

Editor: Ignore theme.json values of unexpected types

This commit prevents WP_Theme_JSON from throwing fatal TypeErrors when theme.json or global styles data contains values of the wrong type.

Those values could be user- or AI-generated.

The checks in this commit cover spacing scale arrays, block variation selectors, and custom block CSS processing.

The motivation arose from a real-life PHP fatal where WP_Theme_JSON::process_blocks_custom_css attempted to explode a non-string.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14190

Props ramonopoly, aaronrobertshaw, andrewserong.

Fixes #66286.

File:

• trunk/src/wp-includes/class-wp-theme-json.php (modified) (8 diffs)

trunk/src/wp-includes/class-wp-theme-json.php

@@ -1141 +1141 @@
                 $scale_path    = array( 'settings', 'spacing', 'spacingScale' );
                 $spacing_scale = _wp_array_get( $this->theme_json, $scale_path, null );
-                if ( null !== $spacing_scale ) {
+                if ( is_array( $spacing_scale ) ) {
                         // If the spacingScale is not already keyed by origin.
                         if ( empty( array_intersect( array_keys( $spacing_scale ), static::VALID_ORIGINS ) ) ) {
@@ -1215 +1215 @@
                                 $block_level_data = $new_theme_json['styles']['blocks'][ $block_type ]['variations'][ $variation_name ] ?? array();
                                 $top_level_data   = $variations[ $variation_name ] ?? array();
-                                $merged_data      = array_replace_recursive( $top_level_data, $block_level_data );
+                                if ( ! is_array( $block_level_data ) || ! is_array( $top_level_data ) ) {
+                                        continue;
+                                }
+                                $merged_data = array_replace_recursive( $top_level_data, $block_level_data );
                                 if ( ! empty( $merged_data ) ) {
                                         _wp_array_set( $new_theme_json, array( 'styles', 'blocks', $block_type, 'variations', $variation_name ), $merged_data );
@@ -1494 +1497 @@
                         $variation_pseudo_selectors = array();
                         foreach ( $input['blockTypes'] as $variation_block_type ) {
-                                if ( isset( static::VALID_BLOCK_PSEUDO_SELECTORS[ $variation_block_type ] ) ) {
+                                if ( is_string( $variation_block_type ) && isset( static::VALID_BLOCK_PSEUDO_SELECTORS[ $variation_block_type ] ) ) {
                                         $variation_pseudo_selectors = array_merge(
                                                 $variation_pseudo_selectors,
@@ -2102 +2105 @@
                 if ( in_array( 'custom-css', $types, true ) ) {
                         // Add the global styles root CSS.
-                        $stylesheet .= _wp_array_get( $this->theme_json, array( 'styles', 'css' ) );
+                        $root_css = $this->theme_json['styles']['css'] ?? '';
+                        if ( is_string( $root_css ) ) {
+                                $stylesheet .= $root_css;
+                        }
                 }
 
@@ -2122 +2128 @@
                 $processed_css = '';
 
-                if ( empty( $css ) ) {
+                if ( empty( $css ) || ! is_string( $css ) ) {
                         return $processed_css;
                 }
@@ -3242 +3248 @@
                  * the URL takes precedence and the ref is ignored.
                  */
-                if ( is_array( $value ) && isset( $value['ref'] ) ) {
+                if ( is_array( $value ) && isset( $value['ref'] ) && is_string( $value['ref'] ) ) {
                         $value_path = explode( '.', $value['ref'] );
                         $ref_value  = _wp_array_get( $theme_json, $value_path );
@@ -4432 +4438 @@
 
                         // Apply the base spacing scale to the current layer.
-                        $base_spacing_scale      = _wp_array_get( $this->theme_json, $scale_path, array() );
-                        $flattened_spacing_scale = array_replace( $flattened_spacing_scale, $base_spacing_scale );
+                        $base_spacing_scale = _wp_array_get( $this->theme_json, $scale_path, array() );
+                        if ( is_array( $base_spacing_scale ) ) {
+                                $flattened_spacing_scale = array_replace( $flattened_spacing_scale, $base_spacing_scale );
+                        }
 
                         $spacing_scale = _wp_array_get( $incoming_data, $scale_path, null );
-                        if ( ! isset( $spacing_scale ) ) {
+                        if ( ! is_array( $spacing_scale ) ) {
                                 continue;
                         }
@@ -5570 +5578 @@
                         ! is_numeric( $spacing_scale['mediumStep'] ) ||
                         ! isset( $spacing_scale['unit'] ) ||
+                        ! is_string( $spacing_scale['unit'] ) ||
                         ! isset( $spacing_scale['operator'] ) ||
                         ( '+' !== $spacing_scale['operator'] && '*' !== $spacing_scale['operator'] ) ||