Fatal error when moderation hash is given as array

[leedxw]

A recent uncommissioned penetration test resulted in PHP Fatal errors

PHP Fatal error:  Uncaught TypeError: hash_equals(): Argument #1 ($known_string) must be of type string, array given in /var/www/html/wp-includes/comment.php:1959

The request was

GET /page-with-comments/?moderation-hash[]=0cdbea79cf8fc31fe70f8d06581b06a8&unapproved=21 HTTP/1.1"

Which triggered a fatal error in using hash_equals() with an array.

if ( $comment && hash_equals( $_GET['moderation-hash'], wp_hash( $comment->comment_date_gmt ) ) ) {

I suggest testing against ! is_array() prior to hash_equals()

[leedxw]

patch to test if moderation-hash is not an array

[SirLouen]

Reproduction Report

Description

This report can't validate that the issue can be reproduced.

Environment

• WordPress: 6.8-beta3-60042-src
• PHP: 8.2.28
• Server: nginx/1.27.4
• Database: mysqli (Server: 8.4.4 / Client: mysqlnd 8.2.28)
• Browser: Chrome 134.0.0.0
• OS: Windows 10/11
• Theme: My Twenty Twenty Child Theme 1.0
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.2.0

Testing Steps:

1. Create a new page with comments enabled, called page with comments
2. Do a GET request witht he following URL:

​https://root_address/page-with-comments/
with the two following parameters
moderation-hash[] = 0cdbea79cf8fc31fe70f8d06581b06a8
unapproved = 21

3. Nothing happens

Actual Results

1. ❌ Error condition doesn't occur

Additional Information

@leedxw can you provide further and more detailed instructions to reproduce this bug?

Supplemental Artifacts