Call to undefined function esc_url() in wp-includes/class-wp-fatal-error-handler.php:190

[rob006]

This bug was introduced in #47681. esc_url() is used for generating error message, but without ensuring that this function is available. In case of using advanced-cache drop-in, this function is not available, so you will get fatal error while handling original error:

PHP Fatal error:  Uncaught Error: Call to undefined function esc_url() in .../wp-includes/class-wp-fatal-error-handler.php:190
Stack trace:
#0 .../wp-includes/class-wp-fatal-error-handler.php(147): WP_Fatal_Error_Handler->display_default_error_template(Array, false)
#1 .../wp-includes/class-wp-fatal-error-handler.php(52): WP_Fatal_Error_Handler->display_error_template(Array, false)
#2 [internal function]: WP_Fatal_Error_Handler->handle()
#3 {main}
  thrown in .../wp-includes/class-wp-fatal-error-handler.php on line 190

[rob006]

I attached two possible patches. First uses htmlspecialchars() for encoding URL, second skips encoding entirely (it is already done in that way in _doing_it_wrong(): ​1 ​2).

[SergeyBiryukov]

Hi there, welcome back to WordPress Trac! Thanks for the report.

Moving to 5.4, as this is a regression in the previous release.

I think no-encode.patch​ would be preferable here, for consistency with _doing_it_wrong().

[SergeyBiryukov]

Replying to SergeyBiryukov:

I think no-encode.patch​ would be preferable here, for consistency with _doing_it_wrong().

For some more context, as previously noted in comment:1:ticket:47385, WordPress core translations are considered safe because we have a review process for them. esc_url() was just used as a best practice precaution here, rather than a requirement.

[SergeyBiryukov]

In 47515:

Site Health: Remove esc_url() used on "Debugging in WordPress" article URL in WP_Fatal_Error_Handler::display_default_error_template().

The function may not be available in some contexts, for example if a fatal error happens in advanced-cache.php drop-in.

Props rob006.
Fixes #49709.

[SergeyBiryukov]

Reopening for backporting to the 5.4 branch after a second committer's review.

[SergeyBiryukov]

In 47523:

Site Health: Remove esc_url() used on "Debugging in WordPress" article URL in WP_Fatal_Error_Handler::display_default_error_template().

The function may not be available in some contexts, for example if a fatal error happens in advanced-cache.php drop-in.

Props rob006.
Reviewed by jorgefilipecosta, SergeyBiryukov.
Merges [47515] to the 5.4 branch.
Fixes #49709.