Make WordPress Core

Opened 8 weeks ago

Closed 8 weeks ago

#64091 closed defect (bug) (wontfix)

Add input validation for $data parameter in wp_add_inline_script()

Reported by: parinpanjari's profile parinpanjari Owned by:
Milestone: Priority: normal
Severity: normal Version: 6.8.3
Component: Script Loader Keywords: 2nd-opinion close
Focuses: Cc:

Description

Problem: The wp_add_inline_style() function in wp-includes/functions.wp-styles.php lacks validation for the $data parameter, expected to be a non-empty string containing CSS. Invalid input (e.g., null, array, or empty string) could cause PHP notices or unexpected behavior in WP_Styles::add_inline_style().

Proposed Fix: Add a type and emptiness check with _doing_it_wrong() notice and return false on failure.

Reasoning:

  • Prevents errors from invalid input.
  • Aligns with WordPress API validation practices.
  • Backward-compatible, only affects invalid calls.

Attachments (1)

functions.wp-styles.php (8.6 KB) - added by parinpanjari 8 weeks ago.

Download all attachments as: .zip

Change History (4)

#1 @swissspidy
8 weeks ago

  • Component changed from General to Script Loader
  • Focuses coding-standards removed
  • Keywords close added

It's really up to the developer to provide the correct data type. Can't be hard to provide a non-empty string. If they do something wrong, they deserve to get a warning. So IMHO we shouldn't add this.

#2 @knutsp
8 weeks ago

WordPress should not prevent PHP errors/warnings from developers.

"Doing it wrong" is for common misconceptions or bad practices, or when the best working/correct way of doing things has changed, things that can not be catched by a simple PHP error or warning.

#3 @westonruter
8 weeks ago

  • Milestone Awaiting Review deleted
  • Resolution set to wontfix
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.