Array to string conversion warning after r50157

[dcavins]

When using the new REST API feature that allows one to add the include_children parameter to a taxonomy-term-filtered request, like

const query = {
    categories: {
        terms: [ 3, 5, 7 ],
        include_children: true,
    },
};

(example taken from ​https://make.wordpress.org/core/2021/02/23/rest-api-changes-in-wordpress-5-7/)

I'm encountering the warning:
PHP Warning: Array to string conversion in /Users/cavinsd/Local Sites/caresnet/app/public/wp-includes/class-wp.php on line 361

The error refers to this line:

$this->query_vars[ $t->query_var ] = str_replace( ' ', '+', $this->query_vars[ $t->query_var ] );

which is expecting a flat taxonomy parameter, not a multidimensional array.

Thanks for adding the include_children parameter; it makes working with the REST API much simpler in some cases!

[dcavins]

Change cleanup logic depending on whether query variable is a string or an array.

[antonvlasenko]

When I use a query like the one in the example, I cannot replicate the issue, at least not with a standard WordPress setup. Here are the queries I've tested:

1. wp/v2/posts?categories%5Bterms%5D%5B0%5D=1&categories%5Bterms%5D%5B1%5D=2&categories%5Bterms%5D%5B2%5D=4&categories%5Binclude_children%5D=1
2. wp/v2/posts?categories%5Bterms%5D%5B0%5D=3&categories%5Bterms%5D%5B1%5D=5&categories%5Bterms%5D%5B2%5D=7&categories%5Binclude_children%5D=true

I am curious to know the exact query used to reproduce the issue.

[dd32]

This warning can also be triggered through a regular GET request, I suspect this is triggering a warning in the REST API request due to WP::parse_request() running on REST API requests, and a taxonomy with the query var 'categories' being registered.

The logic in 60055.01.diff​ likely isn't needed here at all, IMHO, as the categories handling here isn't supposed to be reflected in the WP query being parsed.

For example, with trunk:

GET https://example.org/?category_name[][]=releases

PHP Warning:  Array to string conversion in wp-includes/class-wp.php on line 359
PHP Stack trace:
PHP   1. {main}() index.php:0
PHP   2. require() index.php:18
PHP   3. wp($query_vars = *uninitialized*) wp-blog-header.php:16
PHP   4. WP->main($query_args = '') wp-includes/functions.php:1341
PHP   5. WP->parse_request($extra_query_vars = '') wp-includes/class-wp.php:818
PHP   6. str_replace($search = ' ', $replace = '+', $subject = [0 => [0 => 'release']]) wp-includes/class-wp.php:359

Trac ticket: https://core.trac.wordpress.org/ticket/#comment:2

[leedxw]

We had a number of logs

PHP Warning:  Array to string conversion in /var/www/html/wp-includes/class-wp.php on line 359

and on investigation I found an attacker sending tests to the oembed endpoint, which I can reproduce on 6.9.4 with

curl -v "http://localhost/wp-json/oembed/1.0/embed?tag[][]=&url=http://localhost/hello-world/" -g

which can be avoided with an is_string() test:

--- a/wp-includes/class-wp.php
+++ b/wp-includes/class-wp.php
@@ -355,7 +355,7 @@ class WP {
 
                // Convert urldecoded spaces back into '+'.
                foreach ( get_taxonomies( array(), 'objects' ) as $taxonomy => $t ) {
-                       if ( $t->query_var && isset( $this->query_vars[ $t->query_var ] ) ) {
+                       if ( $t->query_var && isset( $this->query_vars[ $t->query_var ] ) && is_string( $this->query_vars[ $t->query_var ] ) ) {
                                $this->query_vars[ $t->query_var ] = str_replace( ' ', '+', $this->query_vars[ $t->query_var ] );
                        }
                }