PHP warning in WP_Query::get_posts() when url includes ?page[]

[dave1010]

To reproduce:

1. Install WordPress (I cloned from ​https://github.com/WordPress/WordPress, @ [23391])
2. Go to http://example.com/?page[]

Stack trace:

Warning: trim() expects parameter 1 to be string, array given in /var/www/projects/wordpress/wp-includes/query.php on line 2024
Stack trace:

1. {main}() /var/www/projects/wordpress/index.php:0
2. require() /var/www/projects/wordpress/index.php:17
3. wp() /var/www/projects/wordpress/wp-blog-header.php:14
4. WP->main() /var/www/projects/wordpress/wp-includes/functions.php:779
5. WP->query_posts() /var/www/projects/wordpress/wp-includes/class-wp.php:549
6. WP_Query->query() /var/www/projects/wordpress/wp-includes/class-wp.php:485
7. WP_Query->get_posts() /var/www/projects/wordpress/wp-includes/query.php:2972
8. trim() /var/www/projects/wordpress/wp-includes/query.php:2024

Looks like the query var "page" needs sanitizing / casting to string, either with the trim() on line 2024 or before.

[dave1010]

Very similar, not sure if it's worth adding a new ticket. Adding ?s[] to the URL gives an error in the same method:

Warning: stripslashes() expects parameter 1 to be string, array given in /var/www/projects/wordpress/wp-includes/query.php on line 2184

There may be other parameters that need sanitising too.

[mario-siteground]

Is there any practical reason to use that URL format in a real project? IMO handling this for a use-case that wouldn't exist in practice is unnecessary overhead.

[mario-siteground]

also related #23416

[SergeyBiryukov]

Related: [2535]. Duplicate of #17737.