Make WordPress Core

Opened 5 weeks ago

Closed 2 weeks ago

Last modified 2 weeks ago

#65774 closed enhancement (fixed)

Block Supports: Guard against non-string attribute values to avoid fatal errors

Reported by: ramonopoly Owned by: ramonopoly
Priority: normal Milestone: 7.2
Component: General Version: 7.0
Severity: normal Keywords: has-patch has-unit-tests
Cc: Focuses:

Description

A ticket to track the backport of Gutenberg PR: https://github.com/WordPress/gutenberg/issues/80494

WordPress should guard block supports callbacks against non-string (and other wrong-typed) attribute values so they no longer cause fatalTypeErrors on the front end.

block.json / theme.json types aren't enforced at render time, so wrong-typed values from hand-editing, imports, or AI-generated content reach strict PHP ops (explode, preg_match, str_contains, addcslashes, parse_url, array_column, wp_strip_all_tags, array offsets) and fatal in PHP 8+.

This normally doesn't happen because the editor has its own validation checked before saving styles.

Useful is guarding with is_string() / is_array() / is_scalar() before each strict op and treat a wrong-typed value as absent.

Change History (6)

This ticket was mentioned in PR #12674 on WordPress/wordpress-develop by @im3dabasia1.


5 weeks ago
#1

  • Keywords has-patch has-unit-tests added

Trac ticket: https://core.trac.wordpress.org/ticket/65774

## What?
Backport PR of https://github.com/WordPress/gutenberg/issues/80494

Guards block supports callbacks against non-string (and other wrong-typed) attribute values so they no longer cause fatalTypeErrors on the front end. (Block support is handled in a this PR.)

## Why?

block.json / theme.json types aren't enforced at render time, so wrong-typed values from hand-editing, imports, or AI-generated content reach strict PHP ops (explode, preg_match, str_contains, addcslashes, parse_url, array_column, wp_strip_all_tags, array offsets) and fatal in PHP 8+.

## How?
Following the existing idiom guard with is_string() / is_array() / is_scalar() before each strict op and treat a wrong-typed value as absent.

## Testing Instructions
Existing tests should pass

### Testing Instructions for Keyboard
N/A — no UI changes.

## Use of AI Tools
Claude Code

@im3dabasia1 commented on PR #12674:


4 weeks ago
#2

Thanks @ramonjd for the continued efforts to move this PR forward.

I've updated the tests to include the Core ticket. I think this is in good shape for us to ship in WordPress 7.2.

@ramonopoly commented on PR #12674:


4 weeks ago
#3

No problems! FYI we have to hold off on committing this until 7.1 is created: https://wordpress.slack.com/archives/C02RQBWTW/p1785944280374869

#4 @westonruter
3 weeks ago

  • Owner set to ramonopoly
  • Status newreviewing

#5 @ramonopoly
2 weeks ago

  • Resolutionfixed
  • Status reviewingclosed

In 63330:

Block Supports: guard against non-string attribute values to avoid fatal errors

This commit guards layout block supports values with type checks before render.

The reason is that block.json / theme.json types aren't enforced at render time, so wrong-typed values can reach strict PHP checks and cause fatals.

The cause is mainly hand-edited, imported, or AI-generated serialized content, not the block editor.

Developed in: https://github.com/WordPress/wordpress-develop/pull/12674

Props im3dabasia1, ramonopoly, westonruter.

Fixes #65774.

@im3dabasia1 commented on PR #12674:


2 weeks ago
#6

@ramonjd and everyone who helped get this PR through to trunk, really appreciate all the effort and help! 🙌

Note: See TracTickets for help on using tickets.