TypeError: str_contains() argument must be of type string, array given in wp-login.php

[TimoTijhof]

This seems to affect PHP 8.0 and higher.

Downstream report at ​https://github.com/jquery/infrastructure-puppet/issues/34

Seems to be an upstream issue where a $_GET or $_REQUEST key is checked for existence but not for type, thus prone to misuse when crafting query parameters in the array-form that PHP supports.

Easily reproduced, for example, at:

• HTTP 500 ​https://timotijhof.net/wp-login.php?redirect_to[x]=y
• HTTP 500 ​https://jquery.com/wp-login.php?redirect_to[x]=y

[TimoTijhof]

I have a patch at ​https://github.com/WordPress/wordpress-develop/pull/5227.

I've pinged this ticket three different ways, but I'm not seeing anything show up here as is implied by the above notice and the handbook at ​https://make.wordpress.org/core/handbook/contribute/git/github-pull-requests-for-code-review/.

The patch has a failing build due to End-to-end and Performance tests being flaky. I've re-run them a few times and they both pass at different times but not at the same time. I'm guessing that's common enough that it won't hinder the likelihood of code review, so I'll sit back and wait :)

Trac ticket: https://core.trac.wordpress.org/ticket/59373.

This prevents URLs like /wp-login.php?redirect_to[x]=y from triggering a HTTP 500 response as result of

PHP Fatal error: Uncaught TypeError: str_contains():
Argument #1 ($haystack) must be of type string, array given

I considered changing the case for "authorize-application.php" to re-use the $requested_redirect_to variable but left it as-is because this case reads from _GET whereas the variable also considers POST parameters (via _REQUEST), which might be intentional. This case was introduced in [49109] for #42790.

• change 49109: ​https://github.com/WordPress/wordpress-develop/commit/1856d0fe2ad01b53daaf8338a4250088367ac948
• issue 42790: https://core.trac.wordpress.org/ticket/42790

[SergeyBiryukov]

Hi there, thanks for the ticket!

Replying to TimoTijhof:

I have a patch at ​https://github.com/WordPress/wordpress-develop/pull/5227.

I've pinged this ticket three different ways, but I'm not seeing anything show up here as is implied by the above notice

Looks like the PR was attached to #42790 instead due to that ticket being mentioned first in the PR description.

No worries, this is now resolved by moving this ticket's URL to the top of the description.

[SergeyBiryukov]

In 58023:

Login and Registration: Check that redirect_to is a string in wp-login.php.

This prevents a fatal error if an array is passed instead.

Follow-up to [2876], [4969], [7524], [8701], [25701], [31417], [49109].

Props TimoTijhof.
Fixes #59373.

Thanks for the PR! Merged in r58023.