XML-RPC: Fatal TypeError when the fields argument is not an array

[josephscott]

Ten XML-RPC methods accept an optional $fields argument from the client and pass it unvalidated into the _prepare_*() helpers, which call in_array( ..., $fields, true ). A client sending a non-array value causes a fatal error in PHP.

This can happen with:

• wp.getPost
• wp.getPosts
• wp.getTaxonomy
• wp.getTaxonomies
• wp.getUser
• wp.getUsers
• wp.getProfile
• wp.getPostType
• wp.getPostTypes
• wp.getRevisions

It is very easy to reproduce -

curl -s -v http://localhost:8889/xmlrpc.php -H 'Content-Type: text/xml' --data '<?xml version="1.0"?>
<methodCall>
  <methodName>wp.getPosts</methodName>
  <params>
    <param><value><int>1</int></value></param>
    <param><value><string>admin</string></value></param>
    <param><value><string>password</string></value></param>
    <param><value><struct></struct></value></param>
    <param><value><string>[&apos;post_id&apos;, &apos;post_title&apos;]</string></value></param>
  </params>
</methodCall>'

I've got a PR that will look for this and return an error when fields is not an array.

https://core.trac.wordpress.org/ticket/65983

AI assistance: Yes
Tool(s): Claude
Model(s): Fable 5
Used for: It wrote the tests.

Confirming that the tests are “load bearing” when run against trunk:

...............................................................  63 / 348 ( 18%)
............................................................... 126 / 348 ( 36%)
.........................................................E..... 189 / 348 ( 54%)
E....E.......F....E.....F..E.......E........................E.. 252 / 348 ( 72%)
.....E......................................................... 315 / 348 ( 90%)
.................................                               348 / 348 (100%)

Time: 00:11.630, Memory: 243.50 MB

There were 8 errors:

1) Tests_XMLRPC_wp_getPost::test_non_array_fields_returns_error
TypeError: in_array(): Argument #2 ($haystack) must be of type array, string given

/var/www/src/wp-includes/class-wp-xmlrpc-server.php:973
/var/www/src/wp-includes/class-wp-xmlrpc-server.php:1963
/var/www/tests/phpunit/tests/xmlrpc/wp/getPost.php:157

2) Tests_XMLRPC_wp_getPostType::test_non_array_fields_returns_error
TypeError: in_array(): Argument #2 ($haystack) must be of type array, string given

/var/www/src/wp-includes/class-wp-xmlrpc-server.php:1040
/var/www/src/wp-includes/class-wp-xmlrpc-server.php:4603
/var/www/tests/phpunit/tests/xmlrpc/wp/getPostType.php:135

3) Tests_XMLRPC_wp_getPostTypes::test_non_array_fields_returns_error
TypeError: in_array(): Argument #2 ($haystack) must be of type array, string given

/var/www/src/wp-includes/class-wp-xmlrpc-server.php:1040
/var/www/src/wp-includes/class-wp-xmlrpc-server.php:4659
/var/www/tests/phpunit/tests/xmlrpc/wp/getPostTypes.php:52

4) Tests_XMLRPC_wp_getProfile::test_non_array_fields_returns_error
TypeError: in_array(): Argument #2 ($haystack) must be of type array, string given

/var/www/src/wp-includes/class-wp-xmlrpc-server.php:1262
/var/www/src/wp-includes/class-wp-xmlrpc-server.php:2880
/var/www/tests/phpunit/tests/xmlrpc/wp/getProfile.php:57

5) Tests_XMLRPC_wp_getTaxonomies::test_non_array_fields_returns_error
TypeError: in_array(): Argument #2 ($haystack) must be of type array, string given

/var/www/src/wp-includes/class-wp-xmlrpc-server.php:828
/var/www/src/wp-includes/class-wp-xmlrpc-server.php:2656
/var/www/tests/phpunit/tests/xmlrpc/wp/getTaxonomies.php:29

6) Tests_XMLRPC_wp_getTaxonomy::test_non_array_fields_returns_error
TypeError: in_array(): Argument #2 ($haystack) must be of type array, string given

/var/www/src/wp-includes/class-wp-xmlrpc-server.php:828
/var/www/src/wp-includes/class-wp-xmlrpc-server.php:2597
/var/www/tests/phpunit/tests/xmlrpc/wp/getTaxonomy.php:87

7) Tests_XMLRPC_wp_getUser::test_non_array_fields_returns_error
TypeError: in_array(): Argument #2 ($haystack) must be of type array, string given

/var/www/src/wp-includes/class-wp-xmlrpc-server.php:1262
/var/www/src/wp-includes/class-wp-xmlrpc-server.php:2741
/var/www/tests/phpunit/tests/xmlrpc/wp/getUser.php:150

8) Tests_XMLRPC_wp_getUsers::test_non_array_fields_returns_error
TypeError: in_array(): Argument #2 ($haystack) must be of type array, string given

/var/www/src/wp-includes/class-wp-xmlrpc-server.php:1262
/var/www/src/wp-includes/class-wp-xmlrpc-server.php:2828
/var/www/tests/phpunit/tests/xmlrpc/wp/getUsers.php:137

--

There were 2 failures:

1) Tests_XMLRPC_wp_getPosts::test_non_array_fields_returns_error
Failed asserting that Array () is an instance of class "IXR_Error".

/var/www/tests/phpunit/includes/abstract-testcase.php:909
/var/www/tests/phpunit/tests/xmlrpc/wp/getPosts.php:183

2) Tests_XMLRPC_wp_getRevisions::test_non_array_fields_returns_error
Failed asserting that Array () is an instance of class "IXR_Error".

/var/www/tests/phpunit/includes/abstract-testcase.php:909
/var/www/tests/phpunit/tests/xmlrpc/wp/getRevisions.php:92

ERRORS!
Tests: 348, Assertions: 1290, Errors: 8, Failures: 2.

[westonruter]

In 63393:

XML-RPC: Require the $fields argument to be an array.

Ten wp.* methods accept an optional $fields argument from the client and pass it straight through to the _prepare_*() helpers, where in_array() raises a fatal TypeError as soon as the value is not an array. A new wp_xmlrpc_server::_is_fields_array() helper now checks the argument up front, so a malformed request returns a 400 IXR_Error to the client instead of taking the request down with a fatal error.

The affected methods are wp.getPost, wp.getPosts, wp.getTaxonomy, wp.getTaxonomies, wp.getUser, wp.getUsers, wp.getProfile, wp.getPostType, wp.getPostTypes, and wp.getRevisions. Unit tests covering each of them are included, along with the @since entries that were missing from wp_getUser(), wp_getUsers(), and wp_getProfile().

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13299.

Props josephscott, westonruter.
Fixes #65983.