[wp-trac] [WordPress Trac] #60055: Array to string conversion warning after r50157

[WordPress Trac]

#60055: Array to string conversion warning after r50157
--------------------------+------------------------------
 Reporter:  dcavins       |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  REST API      |     Version:  6.4.2
 Severity:  minor         |  Resolution:
 Keywords:  has-patch     |     Focuses:
--------------------------+------------------------------

Comment (by leedxw):

 We had a number of logs

 {{{
 PHP Warning:  Array to string conversion in /var/www/html/wp-includes
 /class-wp.php on line 359
 }}}

 and on investigation I found an attacker sending tests to the oembed
 endpoint, which I can reproduce on 6.9.4 with

 {{{
 curl -v "http://localhost/wp-
 json/oembed/1.0/embed?tag[][]=x&url=https://localhost/hello-world/" -g
 }}}

 which can be avoided with an {{{is_string()}}} test:

 {{{
 --- a/wp-includes/class-wp.php
 +++ b/wp-includes/class-wp.php
 @@ -355,7 +355,7 @@ class WP {

                 // Convert urldecoded spaces back into '+'.
                 foreach ( get_taxonomies( array(), 'objects' ) as
 $taxonomy => $t ) {
 -                       if ( $t->query_var && isset( $this->query_vars[
 $t->query_var ] ) ) {
 +                       if ( $t->query_var && isset( $this->query_vars[
 $t->query_var ] ) && is_string( $this->query_vars[ $t->query_var ] ) ) {
                                 $this->query_vars[ $t->query_var ] =
 str_replace( ' ', '+', $this->query_vars[ $t->query_var ] );
                         }
                 }
 }}}

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/60055#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform