[wp-trac] [WordPress Trac] #62627: PHP warning or fatal error if user supplies array instead of string

[WordPress Trac]

#62627: PHP warning or fatal error if user supplies array instead of string
--------------------------+-----------------------------
 Reporter:  leedxw        |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Feeds         |    Version:  6.7.1
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 A request for `http://localhost/?feed[]=` will produce errors implying no
 checks are made to see if
 a string is actually a string.

 (This is via `parse_query()` `class-wp-query.php:1018`)

 on PHP 7.4:

 {{{
 PHP Warning:  strpos() expects parameter 1 to be string, array given in
 /var/www/html/wp-includes/compat.php on line 498
 PHP Warning:  Illegal offset type in isset or empty in /var/www/html/wp-
 includes/feed.php on line 777
 PHP Warning:  strpos() expects parameter 1 to be string, array given in
 /var/www/html/wp-includes/compat.php on line 498
 PHP Notice:  Array to string conversion in /var/www/html/wp-
 includes/functions.php on line 1612
 }}}

 on PHP8.3:

 {{{
 PHP Fatal error:  Uncaught TypeError: str_contains(): Argument #1
 ($haystack) must be of type string, array given in /var/www/html/wp-
 includes/class-wp-query.php:1018
 ...
 }}}

 We have logging switched on and are currently seeing a lot of probes by
 unknown third-parties that consist of providing arrays where user-supplied
 strings would normally be expected. (Presumably looking for changes in
 output that might indicate an exploitable bug. This can currently be used
 to see if a WordPress site is running with a PHP version below 8.)

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/62627>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform