Skip to content

Guard URL field against non-scalar values#463

Merged
cbravobernal merged 2 commits into
trunkfrom
fix/url-field-nonscalar-value
Jun 12, 2026
Merged

Guard URL field against non-scalar values#463
cbravobernal merged 2 commits into
trunkfrom
fix/url-field-nonscalar-value

Conversation

@cbravobernal

Copy link
Copy Markdown
Contributor

Description

The URL field's validate_value() and format_value() methods can receive a non-scalar value (for example an array) from a form submission, since the submitted value is not guaranteed to be a string. When that happens:

  • validate_value() calls strpos( $value, '://' ), which raises a TypeError on PHP 8 when $value is an array.
  • format_value() calls esc_url( $value ) (which internally calls ltrim()) when escape_html is true, raising a TypeError on an array.

A non-scalar value is never a valid URL, so the field should treat it as invalid/empty rather than raising a fatal TypeError. This PR adds a minimal type guard to both methods:

  • validate_value(): a non-string value returns the existing "Value must be a valid URL" validation message.
  • format_value(): a non-string value returns an empty string when escaping, matching how the field already treats an empty value.

Behavior for normal string values is unchanged.

This file is derived from an upstream plugin; the same change applies upstream.

Verification

  • composer test:php — full suite green (2266 tests), including new regression tests test_validate_value_non_scalar and test_format_value_non_scalar_escaped.
  • composer test:phpstan — clean (no errors).
  • vendor/bin/phpcs on the changed field class and test file — clean (no new violations introduced).

Use of AI Tools

This change was authored by Claude Code under human direction. The human author reviewed and takes responsibility for the change.

🤖 Generated with Claude Code

cbravobernal and others added 2 commits June 12, 2026 12:18
validate_value() and format_value() in the URL field could receive a
non-scalar value (e.g. an array) from a form submission and raised a
TypeError from strpos()/esc_url(). Guard both so a non-string value is
treated as invalid/empty rather than fatally erroring.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Cover validate_value() and format_value() receiving an array value,
ensuring they return an invalid/empty result instead of a TypeError.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props cbravobernal.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@cbravobernal cbravobernal merged commit eabacde into trunk Jun 12, 2026
19 checks passed
@cbravobernal cbravobernal deleted the fix/url-field-nonscalar-value branch June 12, 2026 10:39
@cbravobernal cbravobernal added the [Type] Bug Something isn't working label Jun 12, 2026
@cbravobernal cbravobernal modified the milestones: 6.9.0, 6.8.9 Jun 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

[Type] Bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant