Opened 8 weeks ago
Closed 8 weeks ago
#64091 closed defect (bug) (wontfix)
Add input validation for $data parameter in wp_add_inline_script()
| Reported by: |
|
Owned by: | |
|---|---|---|---|
| Milestone: | Priority: | normal | |
| Severity: | normal | Version: | 6.8.3 |
| Component: | Script Loader | Keywords: | 2nd-opinion close |
| Focuses: | Cc: |
Description
Problem: The wp_add_inline_style() function in wp-includes/functions.wp-styles.php lacks validation for the $data parameter, expected to be a non-empty string containing CSS. Invalid input (e.g., null, array, or empty string) could cause PHP notices or unexpected behavior in WP_Styles::add_inline_style().
Proposed Fix: Add a type and emptiness check with _doing_it_wrong() notice and return false on failure.
Reasoning:
- Prevents errors from invalid input.
- Aligns with WordPress API validation practices.
- Backward-compatible, only affects invalid calls.
Attachments (1)
Change History (4)
#1
@
8 weeks ago
- Component changed from General to Script Loader
- Focuses coding-standards removed
- Keywords close added
Note: See
TracTickets for help on using
tickets.
It's really up to the developer to provide the correct data type. Can't be hard to provide a non-empty string. If they do something wrong, they deserve to get a warning. So IMHO we shouldn't add this.