Make WordPress Core

Opened 6 years ago

Last modified 3 months ago

#49478 new defect (bug)

get_post_type_object has the wrong type of validator for its parameter

Reported by: kamilkecki's profile kamilkecki Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.3.2
Component: Posts, Post Types Keywords: has-patch 2nd-opinion dev-feedback
Focuses: Cc:

Description

https://core.trac.wordpress.org/browser/tags/5.3/src/wp-includes/post.php?rev=46727#L1228

get_post_type_object expects a post type as a string as its parameter, however it checks if the parameter is scalar or not and returns null if it is not a number.

Attachments (1)

49748.diff (582 bytes) - added by sebastienserre 6 years ago.
Change type of check to be sure params is a string

Download all attachments as: .zip

Change History (4)

#1 @SergeyBiryukov
6 years ago

Hi there, welcome to WordPress Trac! Thanks for the ticket.

Just adding a link to the related changeset here: [34100] / #30013.

@sebastienserre
6 years ago

Change type of check to be sure params is a string

#2 @sebastienserre
6 years ago

  • Keywords has-patch needs-testing 2nd-opinion added; needs-patch removed

#3 @huzaifaalmesbah
3 months ago

  • Keywords dev-feedback added; needs-testing removed

Tested both before patch and with 49748.diff on WordPress 7.0-alpha-61215-src.

In both cases, get_post_type_object() returns an object for valid string inputs and null for all non-string values, so the issue is not reproducible functionally.

Before the patch the validator uses is_scalar(), and after the patch it uses is_string(). While the current behavior is already safe due to the array lookup, is_string() better matches the documented parameter type and improves clarity/type safety.

Removing needs-testing and adding dev-feedback, as this appears to be a minor code quality improvement that may need maintainer input.

Last edited 3 months ago by huzaifaalmesbah (previous) (diff)
Note: See TracTickets for help on using tickets.