Skip to content

Query: Add is_scalar validation for attachment and post type query vars #11650

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Sukhendu2002 wants to merge 5 commits into
base: trunk
Choose a base branch
from
+73 −3
Open

Query: Add is_scalar validation for attachment and post type query vars #11650

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1641032
fix: prevent fatal error with malformed post type query vars
Sukhendu2002 Apr 27, 2026
1eff3fb
Tests: Add tests for malformed post type query vars handling
Sukhendu2002 Apr 27, 2026
5474cfa
Merge branch 'trunk' into fix/65123-malformed-post-type-query-var-fatal
Sukhendu2002 Apr 27, 2026
6ad3fbf
Merge branch 'trunk' into fix/65123-malformed-post-type-query-var-fatal
Sukhendu2002 Apr 29, 2026
8c282c5
Query: Improve handling of post type query vars
Sukhendu2002 Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions src/wp-includes/class-wp-query.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -878,6 +878,10 @@ public function parse_query( $query = '' ) {

$query_vars['attachment_id'] = is_scalar( $query_vars['attachment_id'] ) ? absint( $query_vars['attachment_id'] ) : 0;

if ( ! is_scalar( $query_vars['attachment'] ) ) {
$query_vars['attachment'] = '';
}

if ( ( '' !== $query_vars['attachment'] ) || ! empty( $query_vars['attachment_id'] ) ) {
$this->is_single = true;
$this->is_attachment = true;
Expand Down Expand Up @@ -2152,11 +2156,17 @@ public function get_posts() {

if ( ! $ptype_obj->hierarchical ) {
// Non-hierarchical post types can directly use 'name'.
$query_vars['name'] = $query_vars[ $ptype_obj->query_var ];
if ( is_scalar( $query_vars[ $ptype_obj->query_var ] ) ) {
$query_vars['name'] = $query_vars[ $ptype_obj->query_var ];
} else {
$query_vars['name'] = '';
}
Comment thread
Sukhendu2002 marked this conversation as resolved.
Outdated
} else {
// Hierarchical post types will operate through 'pagename'.
$query_vars['pagename'] = $query_vars[ $ptype_obj->query_var ];
$query_vars['name'] = '';
if ( is_scalar( $query_vars[ $ptype_obj->query_var ] ) ) {
$query_vars['pagename'] = $query_vars[ $ptype_obj->query_var ];
}
$query_vars['name'] = '';
Copy link
Copy Markdown
Member

@westonruter westonruter Apr 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this only empty out the name if $query_vars[ $ptype_obj->query_var ] is a scalar?

Copy link
Copy Markdown
Author

@Sukhendu2002 Sukhendu2002 Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The name should be emptied since hierarchical post types operate exclusively through pagename. If the query var is non-scalar, pagename won't be set and name being set to an empty string ensures no unintended matching occurs. Let me know what you think.

}

// Only one request for a slug is possible, this is why name & pagename are overwritten above.
Expand Down
62 changes: 62 additions & 0 deletions tests/phpunit/tests/query/parseQuery.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,6 +234,68 @@ public function test_parse_query_attachment_id_nonscalar() {
$this->assertEmpty( $q->query_vars['attachment_id'] );
}

/**
* Ensure non-scalar 'attachment' value is rejected and attachment flags are not set.
*
* @ticket 65123
*/
public function test_parse_query_attachment_nonscalar() {
$q = new WP_Query();
$q->parse_query(
array(
'attachment' => array( 'foo' => 'bar' ),
)
);

$this->assertEmpty( $q->query_vars['attachment'] );
$this->assertFalse( $q->is_attachment );
$this->assertFalse( $q->is_single );
}

/**
* Ensure a string 'attachment' value sets is_attachment and is_single flags.
*
* @ticket 65123
*/
public function test_parse_query_attachment_scalar() {
$q = new WP_Query();
$q->parse_query(
array(
'attachment' => 'my-image',
)
);

$this->assertSame( 'my-image', $q->query_vars['attachment'] );
$this->assertTrue( $q->is_attachment );
$this->assertTrue( $q->is_single );
}

/**
* Ensure non-scalar post type query var does not cause a fatal error.
*
* @ticket 65123
*/
public function test_parse_query_post_type_query_var_array() {
register_post_type(
'wptests_cpt',
array(
'public' => true,
'query_var' => 'wptests_cpt',
)
);

$q = new WP_Query(
array(
'post_type' => 'wptests_cpt',
'wptests_cpt' => array( 'foo' => 'bar' ),
)
);

unregister_post_type( 'wptests_cpt' );

$this->assertIsArray( $q->posts );
}

/**
* Tests that a fatal error is not thrown when a hierarchical taxonomy query var
* passed to wp_basename() in ::parse_tax_query() is an array instead of a string.
Expand Down
Loading