Skip to content

Elements: Guard against non-string className in render filter #12028

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
aaronrobertshaw wants to merge 8 commits into from
Closed

Elements: Guard against non-string className in render filter #12028

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8386a03
Elements: Guard against non-string className in render filter
aaronrobertshaw Jun 1, 2026
270928b
Re-order docblock
westonruter Jun 8, 2026
4961246
Merge branch 'trunk' into fix/elements-classname-type-guard
westonruter Jun 8, 2026
be0e335
Add type hint
westonruter Jun 8, 2026
7e6542d
Add array shape docs for $block param
westonruter Jun 8, 2026
d5aee5c
Align the wp_render_elements_class_name() and wp_render_custom_css_cl…
westonruter Jun 9, 2026
4265f5f
Fix assertion message
westonruter Jun 9, 2026
b074209
Add phpstan-ignore
westonruter Jun 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/wp-includes/block-supports/elements.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,10 @@ function wp_render_elements_support_styles( $parsed_block ) {
*/
function wp_render_elements_class_name( $block_content, $block ) {
$class_string = $block['attrs']['className'] ?? '';

if ( ! is_string( $class_string ) ) {
return $block_content;
}
preg_match( '/\bwp-elements-\S+\b/', $class_string, $matches );

if ( empty( $matches ) ) {
Expand Down
30 changes: 30 additions & 0 deletions tests/phpunit/tests/block-supports/wpRenderElementsSupport.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,36 @@ public function test_elements_block_support_class( $color_settings, $elements_st
);
}

/**
* Tests that a non-string `className` attribute does not cause a fatal
* error and the block content is returned unmodified.
*
* @ticket 65379
*
* Block attributes such as `className` are always expected to be strings,
* however invalid stored data can result in other types being present. The
* render filter should fail gracefully rather than passing an array to
* `preg_match()`.
Comment thread
westonruter marked this conversation as resolved.
Outdated
*
* @covers ::wp_render_elements_class_name
*/
public function test_elements_block_support_class_with_non_string_class_name() {
$block = array(
'blockName' => 'core/paragraph',
'attrs' => array(
'className' => array( '0', '1' ),
),
);

$block_content = "<p class=\"0 1\">Test</p>\n";

$this->assertSame(
$block_content,
wp_render_elements_class_name( $block_content, $block ),
'Block content should be returned unchanged when className is not a string'
);
}

/**
* Data provider.
*
Expand Down
Loading