Make WordPress Core

Opened 11 months ago

Closed 11 months ago

Last modified 4 months ago

#64091 closed defect (bug) (wontfix)

Add input validation for $data parameter in wp_add_inline_script()

Reported by: parinpanjari Owned by:
Priority: normal Milestone:
Component: Script Loader Version: 6.8.3
Severity: normal Keywords: 2nd-opinion close
Cc: Focuses:

Description

Problem: The wp_add_inline_style() function in wp-includes/functions.wp-styles.php lacks validation for the $data parameter, expected to be a non-empty string containing CSS. Invalid input (e.g., null, array, or empty string) could cause PHP notices or unexpected behavior in WP_Styles::add_inline_style().

Proposed Fix: Add a type and emptiness check with _doing_it_wrong() notice and return false on failure.

Reasoning:

  • Prevents errors from invalid input.
  • Aligns with WordPress API validation practices.
  • Backward-compatible, only affects invalid calls.

Attachments (1)

functions.wp-styles.php (8.6 KB ) - added by parinpanjari 11 months ago.

Download all attachments as: .zip

Change History (5)

#1 @swissspidy
11 months ago

  • Component GeneralScript Loader
  • Focuses coding-standards removed
  • Keywords close added

It's really up to the developer to provide the correct data type. Can't be hard to provide a non-empty string. If they do something wrong, they deserve to get a warning. So IMHO we shouldn't add this.

#2 @knutsp
11 months ago

WordPress should not prevent PHP errors/warnings from developers.

"Doing it wrong" is for common misconceptions or bad practices, or when the best working/correct way of doing things has changed, things that can not be catched by a simple PHP error or warning.

#3 @westonruter
11 months ago

  • Milestone Awaiting Review
  • Resolutionwontfix
  • Status newclosed

This ticket was mentioned in Slack in #accessibility by joedolson. View the logs.


4 months ago

Note: See TracTickets for help on using tickets.