#65774 closed enhancement (fixed)
Block Supports: Guard against non-string attribute values to avoid fatal errors
| Reported by: | ramonopoly | Owned by: | ramonopoly |
|---|---|---|---|
| Priority: | normal | Milestone: | 7.2 |
| Component: | General | Version: | 7.0 |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description
A ticket to track the backport of Gutenberg PR: https://github.com/WordPress/gutenberg/issues/80494
WordPress should guard block supports callbacks against non-string (and other wrong-typed) attribute values so they no longer cause fatalTypeErrors on the front end.
block.json / theme.json types aren't enforced at render time, so wrong-typed values from hand-editing, imports, or AI-generated content reach strict PHP ops (explode, preg_match, str_contains, addcslashes, parse_url, array_column, wp_strip_all_tags, array offsets) and fatal in PHP 8+.
This normally doesn't happen because the editor has its own validation checked before saving styles.
Useful is guarding with is_string() / is_array() / is_scalar() before each strict op and treat a wrong-typed value as absent.
Change History (6)
This ticket was mentioned in PR #12674 on WordPress/wordpress-develop by @im3dabasia1.
5 weeks ago
#1
- Keywords has-patch has-unit-tests added
@im3dabasia1 commented on PR #12674:
4 weeks ago
#2
Thanks @ramonjd for the continued efforts to move this PR forward.
I've updated the tests to include the Core ticket. I think this is in good shape for us to ship in WordPress 7.2.
@ramonopoly commented on PR #12674:
4 weeks ago
#3
No problems! FYI we have to hold off on committing this until 7.1 is created: https://wordpress.slack.com/archives/C02RQBWTW/p1785944280374869
@im3dabasia1 commented on PR #12674:
2 weeks ago
#6
@ramonjd and everyone who helped get this PR through to trunk, really appreciate all the effort and help! 🙌
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
Trac ticket: https://core.trac.wordpress.org/ticket/65774
## What?
Backport PR of https://github.com/WordPress/gutenberg/issues/80494
Guards block supports callbacks against non-string (and other wrong-typed) attribute values so they no longer cause fatal
TypeErrors on the front end. (Block support is handled in a this PR.)## Why?
block.json/theme.jsontypes aren't enforced at render time, so wrong-typed values from hand-editing, imports, or AI-generated content reach strict PHP ops (explode,preg_match,str_contains,addcslashes,parse_url,array_column,wp_strip_all_tags, array offsets) and fatal in PHP 8+.## How?
Following the existing idiom guard with
is_string()/is_array()/is_scalar()before each strict op and treat a wrong-typed value as absent.## Testing Instructions
Existing tests should pass
### Testing Instructions for Keyboard
N/A — no UI changes.
## Use of AI Tools
Claude Code