Skip to content

oEmbed: Fix PHP warnings when a registered provider is malformed#11568

Open
Sukhendu2002 wants to merge 10 commits intoWordPress:trunkfrom
Sukhendu2002:fix/65068-oembed-provider-validation
Open

oEmbed: Fix PHP warnings when a registered provider is malformed#11568
Sukhendu2002 wants to merge 10 commits intoWordPress:trunkfrom
Sukhendu2002:fix/65068-oembed-provider-validation

Conversation

@Sukhendu2002
Copy link
Copy Markdown

@Sukhendu2002 Sukhendu2002 commented Apr 14, 2026

Trac ticket: https://core.trac.wordpress.org/ticket/65068

Use of AI Tools

AI assistance: No


This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

@github-actions
Copy link
Copy Markdown

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

@Sukhendu2002 Sukhendu2002 marked this pull request as ready for review April 14, 2026 07:48
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 14, 2026

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props sukhendu2002, bradshawtm, westonruter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Comment thread src/wp-includes/class-wp-oembed.php Outdated
Copy link
Copy Markdown

@tbradsha tbradsha left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!

Comment thread src/wp-includes/class-wp-oembed.php Outdated
Comment thread src/wp-includes/class-wp-oembed.php Outdated
Comment thread src/wp-includes/class-wp-oembed.php Outdated
Comment thread src/wp-includes/class-wp-oembed.php Outdated
Comment on lines +276 to +295
list( $providerurl, $regex ) = $data;
$providerurl = $data[0];
$regex = $data[1] ?? false;
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this can be reverted.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I kept the defensive $data[0] / $data[1] ?? false instead of reverting to list(). In PHP 8+, list($a, $b) = array('url') throws a warning for undefined offsets. Since $this->providers is a public property, external code (and our own test_get_provider_handles_provider_without_regex_flag) can directly assign single-element arrays to it.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, in that case who's to say that $data[0] even exists or that it is an array?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest adding a new private method, like get_provider( $data ) which returns either array{ endpoint: string, is_regex: bool } or else null if it was too malformed to format. This can take care of (bool) ( $data[1] ?? false ) as well as checking if the data is an array and the first argument is a string. This same method can be used both here and when populating the variable with the return of the oembed_providers filter.

Then the list() can still be eliminated asn we can just access $provider['endpoint'] and $provider['is_regex'] as opposed to creating new variables.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

er, get_provider is a bad name because it is used already! Maybe sanitize_provider() or format_provider() or prepare_provider() or something.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point! Added a private sanitize_provider() method.

Comment thread src/wp-includes/class-wp-oembed.php Outdated
Comment thread src/wp-includes/class-wp-oembed.php Outdated
Comment thread src/wp-includes/class-wp-oembed.php
Comment thread src/wp-includes/class-wp-oembed.php Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants