Fatal Error/Warning when invalid `sitemap` query var presented.

[dd32]

A request such as ​https://example.org/?sitemap[foo]=bar will result in a fatal error being generated under PHP8, and a warning under PHP7.

PHP 7.4:
E_WARNING: Illegal offset type in isset or empty in wp-includes/sitemaps/class-wp-sitemaps-registry.php:68


PHP8.1:
Fatal error: Uncaught Error: Illegal offset type in isset or empty
in wp-includes/sitemaps/class-wp-sitemaps-registry.php on line 68

Call stack:
WP_Sitemaps_Registry::get_provider()
wp-includes/sitemaps.php:114
get_sitemap_url()
wp-includes/canonical.php:428
redirect_canonical()
wp-includes/class-wp-hook.php:307
...

This is partially related to #17737

[costdev]

A quick attempt to reproduce this by appending ?sitemap[foo]=bar to the home url on a local (alpha, PHP 7.2) and remote (6.0.1, PHP 7.4) site failed to produce a warning/error.

Are there any other settings/steps required to produce this?

Edit: Nevermind, got it. Hadn't realised the sitemap plugin was deactivated.

[costdev]

I'm getting the warning for illegal offset type when appending ?sitemap[foo]=bar, but in my case it's wp-includes/taxonomy.php:

Warning: Illegal offset type in isset or empty in src/wp-includes/taxonomy.php on line 340

Looks like both may need an is_string() check on the value being passed to isset(). Both are documented as a string.

[costdev]

Add type checks to WP_Sitemaps_Registry::get_provider() and taxonomy_exists().

[dd32]

Thanks @costdev!

Adding the type check to WP_Sitemaps_Registry::get_provider() appears to work for me, the taxonomy_exists() change didn't seem to be required in my environment but I can't see any harm in it or reason not to include it in the same change.

Trac ticket: https://core.trac.wordpress.org/ticket/56336

[peterwilsoncc]

In 53838:

Sitemaps: Prevent invalid provider names throwing errors.

Validate the requested sitemap is a string before attempting to use it in a provider. This prevents WP_Sitemaps_Registry::get_provider() from triggering a fatal error in more recent versions of PHP.

The errors can be triggered by items outside the site owner or developers control (such as a user visiting ?sitemap[foo]=bar) so the code fails silently to avoid filling error logs with unfixable errors.

Props costdev, dd32.
Fixes #56336.

Merged https://core.trac.wordpress.org/changeset/53838 / b96a51c529

[audrasjb]

In 53869:

Taxonomy: Prevent non string taxonomy names generating warnings or errors.

This changeset adds an is_string( $taxonomy ) check to the condition in taxonomy_exists(), to ensure false is returned when the $taxonomy is not a string.

Follow-up to [35718].

Props costdev, peterwilsoncc, mukesh27.
Fixes #56338.
See #56336.