REST API: Restore `is_array()` check in `rest_convert_error_to_response()` by nate-allen · Pull Request #11307 · WordPress/wordpress-develop

nate-allen · 2026-03-19T14:28:11Z

61429 (part of the Code Modernization effort, #63430) replaced the isset() ternary in rest_convert_error_to_response() with a null coalescing operator, removing the is_array() guard. Since WP_Error::get_all_error_data() can return data of any type, this causes a PHP fatal error when error data is a stdClass object.

This PR reverts the line to its original form and adds a test case for stdClass error data.

Trac ticket: https://core.trac.wordpress.org/ticket/64901

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 4.6
Used for: Identifying the regression by diffing 6.9.4 and 7.0-beta5, and writing the test case. The fix itself is a direct revert of the changed line. All code was reviewed by me.

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

…se()`. The null coalescing conversion in [61429] removed the `is_array()` guard when accessing `$error_data['status']`. Since `WP_Error` data can be any type (including `stdClass`), this causes a PHP fatal error when non-array data is passed. This restores the type check while still using null coalescing for the array case. Props costdev, westonruter. Fixes #64901. See #63430.

…_array().

github-actions · 2026-03-19T14:28:23Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props nateallen, westonruter, mukesh27.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-03-19T14:31:51Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

src/wp-includes/rest-api.php

westonruter · 2026-03-24T16:59:39Z

Thank you for addressing this.

The prior change was indeed wrong because \WP_Error::get_all_error_data() returns mixed[]:

wordpress-develop/src/wp-includes/class-wp-error.php

Lines 233 to 241 in 6607b4d

    
           	/** 
        
           	 * Retrieves all error data for an error code in the order in which the data was added. 
        
           	 * 
        
           	 * @since 5.6.0 
        
           	 * 
        
           	 * @param string|int $code Error code. 
        
           	 * @return mixed[] Array of error data, if it exists. 
        
           	 */ 
        
           	public function get_all_error_data( $code = '' ) {

I was curious why I wasn't seeing PHPStan flag this issue locally since where I have the PHPStan rule level 8 enforced. Only when I switched to rule level 9 did PHPStan catch the issue because it will:

be strict about explicit mixed type - the only allowed operation you can do with it is to pass it to another mixed

Once I did that, it was caught:

westonruter · 2026-03-24T17:09:04Z

src/wp-includes/rest-api.php

 		static function ( $status, $error_data ) {
-			return $error_data['status'] ?? $status;
+			// Note: $error_data may not be an array (e.g. stdClass), so is_array() check is intentional.
+			return is_array( $error_data ) && isset( $error_data['status'] ) ? $error_data['status'] : $status;


There is an opportunity to further harden this, however. Namely, there is no guarantee that $error_data['status'] is an integer. If it is something else, then the $status will get passed to new WP_REST_Response( $data, $status ) which will then get passed into \WP_HTTP_Response::set_status() and ultmately passed here:

wordpress-develop/src/wp-includes/class-wp-http-response.php

Lines 115 to 117 in bd3f983

public function set_status( $code ) {

$this->status = absint( $code );

}

Passing a non-numeric value to absint() results in a value of 1 being set as the status. This is not a fatal error, but it is wrong. Therefore, this would be even safer:

Suggested change

return is_array( $error_data ) && isset( $error_data['status'] ) ? $error_data['status'] : $status;

if ( is_array( $error_data ) && isset( $error_data['status'] ) && is_numeric( $error_data['status'] ) ) {

$status = (int) $error_data['status'];

}

return $status;

Thanks! Great suggestion. I've added the is_numeric() check and (int) cast, along with a test for non-numeric status values.

@nate-allen Great! I also followed up with ea57364 to add explicit types, to use phpdoc instead of the inline comment, and I updated the test to account for the possibility that there could be more than one data item added that has status. Please take a look.

Looks great! The type hints and expanded multi-status test are nice additions

…error_to_response().

…tatuses in data

…f non-array error data when obtaining `status`. While the error data is normally an array, this is not guaranteed. This issue would have been detected by PHPStan rule level 9, since `WP_Error::get_all_error_data()` returns `mixed[]`. Developed in #11307 Follow-up to r61429. Props nateallen, desrosj, jorbin, mukesh27, westonruter. See #63430. Fixes #64901. git-svn-id: https://develop.svn.wordpress.org/trunk@62107 602fd350-edb4-49c9-b593-d223f7449a82

github-actions · 2026-03-24T17:39:16Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 62107
GitHub commit: 6a568e8

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

…f non-array error data when obtaining `status`. While the error data is normally an array, this is not guaranteed. This issue would have been detected by PHPStan rule level 9, since `WP_Error::get_all_error_data()` returns `mixed[]`. Developed in WordPress/wordpress-develop#11307 Follow-up to r61429. Props nateallen, desrosj, jorbin, mukesh27, westonruter. See #63430. Fixes #64901. Built from https://develop.svn.wordpress.org/trunk@62107 git-svn-id: http://core.svn.wordpress.org/trunk@61389 1a063a9b-81f0-0310-95a4-ce76da25c4cd

nate-allen added 2 commits March 19, 2026 10:19

Revert to original isset() ternary instead of null coalescing with is…

e060139

…_array().

nate-allen changed the title ~~Fix/rest convert error stdclass~~ REST API: Restore is_array() check in rest_convert_error_to_response() Mar 19, 2026

mukeshpanchal27 reviewed Mar 19, 2026

View reviewed changes

src/wp-includes/rest-api.php Outdated Show resolved Hide resolved

Add inline comment explaining the is_array() check.

d88933d

westonruter reviewed Mar 24, 2026

View reviewed changes

nate-allen and others added 3 commits March 24, 2026 13:17

Add is_numeric() check and int cast for error status in rest_convert_…

6398886

…error_to_response().

Merge branch 'trunk' into fix/rest-convert-error-stdclass

1692243

Use phpdoc for type def, add type hints, and add test with multiple s…

ea57364

…tatuses in data

westonruter approved these changes Mar 24, 2026

View reviewed changes

github-actions bot closed this Mar 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

REST API: Restore `is_array()` check in `rest_convert_error_to_response()`#11307

REST API: Restore `is_array()` check in `rest_convert_error_to_response()`#11307
nate-allen wants to merge 6 commits intoWordPress:trunkfrom
nate-allen:fix/rest-convert-error-stdclass

nate-allen commented Mar 19, 2026

Uh oh!

github-actions bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 19, 2026

Uh oh!

Uh oh!

westonruter commented Mar 24, 2026

Uh oh!

westonruter Mar 24, 2026

Uh oh!

nate-allen Mar 24, 2026

Uh oh!

westonruter Mar 24, 2026

Uh oh!

nate-allen Mar 24, 2026

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	public function set_status( $code ) {
	$this->status = absint( $code );
	}

-			return is_array( $error_data ) && isset( $error_data['status'] ) ? $error_data['status'] : $status;
+			if ( is_array( $error_data ) && isset( $error_data['status'] ) && is_numeric( $error_data['status'] ) ) {
+				$status = (int) $error_data['status'];
+			}
+			return $status;

Conversation

nate-allen commented Mar 19, 2026

Use of AI Tools

Uh oh!

github-actions bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 19, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

Uh oh!

westonruter commented Mar 24, 2026

Uh oh!

westonruter Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

nate-allen Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

westonruter Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

nate-allen Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Mar 19, 2026 •

edited

Loading