[wp-trac] [WordPress Trac] #62643: Prevent errors from `printf()` and `sprintf()` calls

[WordPress Trac]

#62643: Prevent errors from `printf()` and `sprintf()` calls
-------------------------+-----------------------------
 Reporter:  grapestain   |      Owner:  (none)
     Type:  enhancement  |     Status:  new
 Priority:  normal       |  Milestone:  Awaiting Review
Component:  I18N         |    Version:
 Severity:  normal       |   Keywords:
  Focuses:               |
-------------------------+-----------------------------
 I've just faced a strange issue today. At least it was strange at first.
 I've just updated a Canadian English site from WP v6.6.2 to v6.7.1 and
 when the redirect to the `wp-admin/about.php` page happened the page threw
 a Fatal error:

 {{{
 Fatal error: Uncaught Error: 3 arguments are required, 2 given
 in /home/happyeco/public_html/wp-admin/about.php on line 260
 }}}

 Looking into it further I've found that the en_CA translated string for
 the given `printf` call contained two placeholders while the PHP source
 string only had one and only passed one argument.

 So okay, that is an issue with the translation itself, but that is fairly
 simple to fix and I think I'll just go to the translations site and fix it
 there. Meanwhile I've monkey patched my `about.php` to pass an extra
 argument to prevent fatal errors.

 But I'm opening this issue to address the problem in a broader sense.

 Since PHP v8.0 `fprintf()`, `sprintf()` and similar functions no longer
 emit a warning but they throw an error if the passed number of arguments
 are less than the number of placeholders in the format specifier string.
 E.g.: https://www.php.net/manual/en/function.fprintf.php#refsect1-function
 .fprintf-changelog

 What this means to me is that sites can be crashed by translation
 mistakes, which seem to be an issue to me. Just think about it how bad
 it'd look if somehow someone added one extra format specifier to one of a
 widely used string of a popular language's translations. WordPress sites
 could suddenly start to crash in masse. I think the whole platform is
 sitting on a ticking bomb with this PHP change.

 For me it seems to be quite obvious that a wrong/missing/incorrect UI
 string is way better than a crashed site.

 And this means to me that WordPress should implement wrapper functions for
 `fprintf()`, `sprintf()` and similar function (not sure which ones are
 used in the codebase) that implement proper error handling preventing
 crashes and instead omitting warnings or log entries. All calls to
 `fprintf()`, `sprintf()` should be replaced with calls to the wrapper
 functions and plugin and theme authors should also be encouraged to
 replace usages in their codebase.

 What do you think?

 I assume such large scale change should pass several checks to happen, but
 in theory it is a pretty low risk change in terms of the complexity of the
 refactoring. Basically it is just adding few new functions and doing
 search-n-replace on the rest of the codebase.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/62643>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform