Context Navigation

← Previous Ticket
Next Ticket →

#64479 closed defect (bug) (fixed)

XML-RPC addTwoNumbers needs to check arg types

Reported by:	josephscott	Owned by:	westonruter
Priority:	normal	Milestone:	7.0
Component:	XML-RPC	Version:	1.5
Severity:	normal	Keywords:	has-patch has-unit-tests
Cc:		Focuses:

Description

The current addTwoNumbers code will generate a fatal error in PHP when given something unexpected. It is trivial to reproduce this problem via:

curl -v -H "content-type:text/xml" http://localhost:8889/xmlrpc.php -d "<?xml version="1.0"?><methodCall><methodName>demo.addTwoNumbers</methodName><params><param><value><int>3</int></value></param><param><value><string>abc</string></value></param></params></methodCall>"

That generates a 500 Internal Server Error response:

<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
  <fault>
    <value>
      <struct>
        <member>
          <name>faultCode</name>
          <value><int>500</int></value>
        </member>
        <member>
          <name>faultString</name>
          <value><string>&lt;p&gt;There has been a critical error on this website.&lt;/p&gt;&lt;p&gt;&lt;a href=&quot;https://wordpress.org/documentation/article/faq-troubleshooting/&quot;&gt;Learn more about troubleshooting WordPress.&lt;/a&gt;&lt;/p&gt;</string></value>
        </member>
      </struct>
    </value>
  </fault>
</methodResponse>

In general WordPress shouldn't fall over with a fatal error when given something unexpected. I've got a trivial patch to addTwoNumbers to catch this condition and return a helpful error message ( as a 200 OK ):

<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
  <fault>
    <value>
      <struct>
        <member>
          <name>faultCode</name>
          <value><int>400</int></value>
        </member>
        <member>
          <name>faultString</name>
          <value><string>Invalid arguments passed to this XML-RPC method.  Requires two integers.</string></value>
        </member>
      </struct>
    </value>
  </fault>
</methodResponse>

As the docs indicate that addTwoNumbers takes two integers as arguments - https://developer.wordpress.org/reference/classes/wp_xmlrpc_server/addtwonumbers/ - that is what the code should check for and enforce.