Global Styles: Remove preset items of unexpected types to prevent fatals in PHP

[ramonopoly]

Follow up to https://core.trac.wordpress.org/ticket/66286

Tracks backport of ​https://github.com/WordPress/gutenberg/pull/84534

To prevent fatals caused by invalid theme.json values:

• remove preset items that aren't objects, or whose slug isn't a scalar, in WP_Theme_JSON::sanitize().

Invalid theme.json values can be introduced via the global styles CPT, e.g., if an AI-generates it for you!

Backports ​https://github.com/WordPress/gutenberg/pull/84534

Follow-up to https://core.trac.wordpress.org/changeset/64309 (#66286).

What

Removes theme.json preset items that aren't objects, or whose slug isn't a scalar, in WP_Theme_JSON::sanitize().

Why

Preset leaves are untyped in VALID_SETTINGS, so these items reach code that reads $preset['slug'] as a string. On trunk they throw a fatal TypeError:

• A preset list of strings, such as "fontFamilies": [ "Inter" ], fails with Cannot access offset of type string on string when the stylesheet is generated.
• A preset with an array slug fails in preg_match_all().
• A palette keyed by origin with a string item, saved through the kses filter, fails in remove_insecure_settings().

What changed

• sanitize() drops those items from plain preset lists and from lists keyed by origin, at the top level and per block. The filter lives in sanitize() rather than the constructor because remove_insecure_properties() (the kses save path) calls sanitize() but never constructs a WP_Theme_JSON.
• Scalar slugs are kept, so an integer slug still works.

Valid data is unaffected. The Gutenberg PR also changes get_base_custom_css(), which only exists in the plugin, so there's nothing to port for it.

Each case has a test. All seven new cases fail on trunk.

[im3dabasia1]

I’m going through the 7.2 tickets ahead of beta 1.

Thank you for the work on this, @ramonopoly. I see the Gutenberg PR is merged, while the core PR still needs a review, and beta 1 is only a few days away.

Is 7.2 a realistic target for this? If it needs more time, we can move it to 7.3.

[ramonopoly]

Thanks for the nudge @im3dabasia1

I'll try to get this in today or latest tomorrow

[ramonopoly]

In 64491:

Editor: Remove theme.json preset items of unexpected types to prevent fatals in PHP

This commit prevents WP_Theme_JSON from throwing fatal TypeErrors when preset items in theme.json or global styles data contain values of the wrong type. Those values could be user- or AI-generated.

It does this by removing theme.json preset items that aren't objects, or whose slug isn't a scalar, in WP_Theme_JSON::sanitize().

Previouly, for example, a preset list of strings, such as "fontFamilies": [ "Inter" ], failed with Cannot access offset of type string on string when the stylesheet is generated.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14262

Props ramonopoly, aaronrobertshaw, isabel_brison.

Fixes #66304.