Make WordPress Core

Opened 7 years ago

Last modified 7 months ago

#49478 new defect (bug)

get_post_type_object has the wrong type of validator for its parameter

Reported by: kamilkecki Owned by:
Priority: normal Milestone: Awaiting Review
Component: Posts, Post Types Version: 5.3.2
Severity: normal Keywords: has-patch 2nd-opinion dev-feedback
Cc: Focuses:

Description

https://core.trac.wordpress.org/browser/tags/5.3/src/wp-includes/post.php?rev=46727#L1228

get_post_type_object expects a post type as a string as its parameter, however it checks if the parameter is scalar or not and returns null if it is not a number.

Attachments (1)

49748.diff (582 bytes ) - added by sebastienserre 7 years ago.
Change type of check to be sure params is a string

Download all attachments as: .zip

Change History (4)

#1 @SergeyBiryukov
7 years ago

Hi there, welcome to WordPress Trac! Thanks for the ticket.

Just adding a link to the related changeset here: [34100] / #30013.

@sebastienserre
7 years ago

Change type of check to be sure params is a string

#2 @sebastienserre
7 years ago

  • Keywords has-patch needs-testing 2nd-opinion added; needs-patch removed

#3 @huzaifaalmesbah
7 months ago

  • Keywords dev-feedback added; needs-testing removed

Tested both before patch and with 49748.diff on WordPress 7.0-alpha-61215-src.

In both cases, get_post_type_object() returns an object for valid string inputs and null for all non-string values, so the issue is not reproducible functionally.

Before the patch the validator uses is_scalar(), and after the patch it uses is_string(). While the current behavior is already safe due to the array lookup, is_string() better matches the documented parameter type and improves clarity/type safety.

Removing needs-testing and adding dev-feedback, as this appears to be a minor code quality improvement that may need maintainer input.

Last edited 7 months ago by huzaifaalmesbah (previous) (diff)
Note: See TracTickets for help on using tickets.