Changeset 49803

Timestamp:

12/16/2020 12:49:32 AM (19 months ago)

Author:

iandunn

Message:

Feed: Merge multiple header values to avoid fatal error.

When SimplePie parses HTTP headers, it combines multiple values for the same header into a comma-separated string. WP_SimplePie_File overrides the parsing, but was leaving them as an array instead.

That lead to a fatal error in PHP 8, because other parts of the codebase ended up passing an array to a function that expected a string.

Props david.binda, litemotiv, inc2734, NicolasKulka, hellofromTonya, mbabker, skithund, SergeyBiryukov, desrosj, timothyblynjacobs.
Fixes #51056. See #51956.

Location:

trunk

Files:

• src/wp-includes/class-wp-simplepie-file.php (modified) (3 diffs)
• tests/phpunit/data/feed (added)
• tests/phpunit/data/feed/wordpress-org-news.xml (added)
• tests/phpunit/tests/feed/wp-simplepie-file.php (added)

trunk/src/wp-includes/class-wp-simplepie-file.php

@@ -11 +11 @@
  * Core class for fetching remote files and reading local files with SimplePie.
  *
+ * This uses Core's HTTP API to make requests, which gives plugins the ability
+ * to hook into the process.
+ *
  * @since 2.8.0
  *
@@ -22 +25 @@
      * @since 2.8.0
      * @since 3.2.0 Updated to use a PHP5 constructor.
+     * @since 5.6.1 Multiple headers are concatenated into a comma-separated string, rather than remaining
+     *              an array.
      *
      * @param string       $url             Remote file URL.
@@ -61 +66 @@
                 $this->error   = 'WP HTTP Error: ' . $res->get_error_message();
                 $this->success = false;
+
             } else {
-                $this->headers     = wp_remote_retrieve_headers( $res );
+                $this->headers = wp_remote_retrieve_headers( $res );
+
+                /*
+                 * SimplePie expects multiple headers to be stored as a comma-separated string, but
+                 * `wp_remote_retrieve_headers()` returns them as an array, so they need to be
+                 * converted.
+                 *
+                 * The only exception to that is the `content-type` header, which should ignore any
+                 * previous values and only use the last one.
+                 *
+                 * @see SimplePie_HTTP_Parser::new_line().
+                 */
+                foreach ( $this->headers as $name => $value ) {
+                    if ( ! is_array( $value ) ) {
+                        continue;
+                    }
+
+                    if ( 'content-type' === $name ) {
+                        $this->headers[ $name ] = array_pop( $value );
+                    } else {
+                        $this->headers[ $name ] = join( ', ', $value );
+                    }
+                }
+
                 $this->body        = wp_remote_retrieve_body( $res );
                 $this->status_code = wp_remote_retrieve_response_code( $res );