`WP_Ugrader` doesn't check source and destination variable types, is missing a string.

[peterwilsoncc]

As discovered by @costdev, @jipmoors and @karlijnbok while working on #54245 the WP_Ugrader class:

• fails to accurately check the source and destination directories are valid strings
• is missing the no_package string: Package not available.

These fixes were initially included in ​PR #3044 but went uncommitted as the tests were committed during the release candidate phase of the release cycle.

https://core.trac.wordpress.org/ticket/59712#ticket

[swissspidy]

@peterwilsoncc Is this one on your radar for 6.5 or would you like to punt?

[peterwilsoncc]

@swissspidy I think it would be good to get some manual testing done first. Are you happy to keep it on the milestone for a few days and punt on Wednesday or Thursday if nothing happens?

[swissspidy]

I'm punting for now based on the above. Feel free to move back if there's been some testing in the meantime.

[afragen]

In testing the PR does function correctly but I found a possible flaw. If $args['source'] is a string and has leading or trailing spaces it passes the PR check, however, it fails the following line 566. I don’t even know if this edge case is possible. If not then the PR tests out fine.

$source = trailingslashit( $args['source'] ) . trailingslashit( $source_files[0] );

I also ran tests separately and all passing.

[peterwilsoncc]

@afragen @costdev Do you think the check should be this instead?

<?php
if (
        ( ! is_string( $source ) || $source !== trim( $source ) ) ||
        ( ! is_string( $destination ) || $destination !== trim( $destination ) )
) {

An alternative would be to reassign the values with their trimmed versions and check for an empty string.

[afragen]

@peterwilsoncc that looks like it should cover the edge case above and upon a closer look does seem that it should catch empty strings. Does it pass the tests?

[peterwilsoncc]

Good catch, Andy, I've used your suggestion and pushed it with some additional test cases.

It's possibly a little overkill but if WordPress is going to test for invalid strings, it should at least do it completely.

[peterwilsoncc]

In 58022:

Upgrade/Install: Validate source & destination values in WP_Ugrader.

Adds a missing string and some additional validation of paths in the upgrader class.

Follow up to [56992].

Props costdev, jipmoors, karlijnbok, swissspidy, afragen, mukesh27.
Fixes #59712.

Merged in r58022 / ​https://github.com/WordPress/wordpress-develop/commit/5ae18c46d2604b244660d43af2117eb33bced0a4