Guard ExcludedEncodeContentSC filter entry points against non-string input - #856
Open
MikeWard0321 wants to merge 1 commit into
Open
Conversation
…input changeContentBeforeEncoderModify() and changeContentAfterEncoderModify() are registered directly as WordPress filter callbacks by ShortCodesService, so they receive whatever value the filter carries, which is not always a string. Both then pass that value to preg_match_all() and preg_replace_callback() without checking it. On PHP 8.1+ a null value emits "Passing null to parameter #N ($subject) of type string is deprecated"; on PHP 9 the same call becomes a TypeError. EncodeContentSC, the sibling class attached to the same filters by the same ShortCodesService methods, already guards both of its entry points with exactly this check. This applies the same guard to ExcludedEncodeContentSC so the two classes behave consistently on the hooks they share.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ExcludedEncodeContentSC::changeContentBeforeEncoderModify()and::changeContentAfterEncoderModify()are registered directly as WordPress filter callbacks, so they receive whatever value the filter carries — which is not always a string. Neither checks before passing that value topreg_match_all()/preg_replace_callback().Its sibling
EncodeContentSCis attached to the same filters by the sameShortCodesServicemethods and already guards both of its entry points with exactly this check. This PR applies the same guard toExcludedEncodeContentSCso the two classes behave consistently on the hooks they share.The inconsistency
ShortCodesServiceregisters both classes together:changeContentBeforeEncoderModify()changeContentAfterEncoderModify()EncodeContentSCExcludedEncodeContentSCExcludedEncodeContentSC::processTitleString()(line 879) also already handles the null case explicitly, so the class does anticipate non-string input elsewhere — just not at the two filter entry points.Observed behaviour
With a
nullfilter value,changeContentBeforeEncoderModify()passes it toisShortcodeInsideHtmlAttribute()→preg_match_all()at line 521, then topreg_replace_callback()at line 85:Both fire on every affected page render. On PHP 9 these become a
TypeErrorrather than a deprecation.Environment: Spam protection, Anti-Spam, FireWall by CleanTalk 6.85, WordPress 7.0.4, PHP 8.4.24, nginx + PHP-FPM. Line numbers above are against current
master.The change
Adds the existing guard to both entry points — 8 lines, no behaviour change for string input:
Returning
$contentunmodified preserves filter semantics for any non-string value rather than coercing it, matching whatEncodeContentSCalready does.Verification
Applied to a production site running 6.85 on PHP 8.4.24. Before: the deprecation pair on every render of an affected page. After: no deprecations across repeated requests to the same pages, with page output and rendered content unchanged.