Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Customizer responsive sanitizer fatals when input is an array

Aperta Adatta ai principianti
  • Qualcosa non va?
#4,651 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@HardeepAsrani ci sta già lavorando.

Dal 9/10/2026.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
66/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
php, wordpress
Ambito
backend

Direzione di ricerca

Inizia da sanitize_responsive_int_json() in header-footer-grid/Traits/Core.php (circa righe 77-86), dove json_decode($input, true) viene eseguito prima di qualsiasi controllo del tipo, e dalla registrazione del sanitizer in header-footer-grid/Core/Builder/Abstract_Builder.php. Poi leggi tests/test-neve-sanitization.php, il cui helper codifica in JSON i fixture, quindi l'input come array nativo non viene mai testato. Il lavoro è completato quando un array nativo non causa più un fatal, gli input stringa serializzata vengono ancora sanificati come prima e un test copre il caso dell'array.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug-report bug-report-triage crash-report

Summary

When a responsive Customizer setting is submitted as an array, the sanitizer can terminate the request with a TypeError instead of returning a sanitized value. This interrupts the affected Customizer preview request.

Customer context

Product / area: Neve, Header Footer Grid responsive Customizer settings
Version: Neve 4.2.16
Environment: WordPress 7.1.3; PHP 8.3.31 and 8.4.26
Integration / third party: Not identified as relevant
Reported error / symptom: json_decode(): Argument #1 ($json) must be of type string, array given
Impact: The fatal interrupts the affected Customizer preview request; two sites were represented in telemetry.

Reproduction notes

Production telemetry captured this during a frontend request in the Customizer preview/sanitization path on Neve 4.2.16. The exact responsive setting and submitted payload are not available. The source-level failure can be exercised by calling sanitize_responsive_int_json() with an array on a PHP version that rejects non-string input to json_decode(); no local runtime reproduction was performed.

Diagnosis

Conclusion

Confirmed product defect: production telemetry records an array reaching sanitize_responsive_int_json(), and the Neve 4.2.16 implementation passes that value directly to json_decode(). The reported TypeError matches this source path.

Where this likely occurs
  • header-footer-grid/Traits/Core.php — Abstract_Component::sanitize_responsive_int_json() approx. lines 77–86 calls json_decode($input, true) before validating the input type.
  • header-footer-grid/Core/Builder/Abstract_Builder.php — responsive setting registration approx. lines 400–402 attaches the sanitizer callback.
  • tests/test-neve-sanitization.php — do_assertion_for_sanitize_responsive_int_json() lines 241–243 JSON-encodes its array fixtures before invoking the sanitizer.
Engineering notes

The crash is reported for Neve 4.2.16 on PHP 8.3 and 8.4. The stack identifies the Customizer setting sanitization path, and the telemetry gives direct evidence that the callback received an array. Existing tests cover array-shaped values only after JSON encoding, not the native array input reported here. No regression boundary was identified; the method has existed since 2019.

Test coverage status

tests/test-neve-sanitization.php::test_sanitize_responsive_int_json() covers serialized JSON input, including fixtures initially represented as arrays. Its helper encodes those fixtures before the sanitizer call, so relevant native-array input coverage is absent from the inspected test path. No test suite was run.

What to verify or explore next
  • Reproduce the reported Customizer callback path with a native array input on the affected PHP versions.
  • Identify which responsive setting and client payload produce the array in the Customizer request.
  • Confirm behavior for existing serialized-string inputs alongside the reported native-array case.
Unknowns / follow-up

The exact setting identifier, request payload, and triggering user interaction were not captured in the telemetry report.

Confidence

Confidence: 98/100

The Neve 4.2.16 Customizer crash is confirmed by production telemetry and source: the sanitizer passes the reported array directly to json_decode(). The three loader fingerprints all resolve to an unguarded require in Neve 4.1.4/4.2.2/4.2.6, while v4.2.14 contains a missing-file guard, so those older-version signals do not warrant a new issue when a fixed release is available.

Crash telemetry
Occurrences 20
Distinct sites 2
First seen 2026-10-07 20:18 UTC
Last seen 2026-10-08 15:09 UTC
Crash location product:header-footer-grid/Traits/Core.php:78
Request context frontend
Inside Themeisle SDK no
Product versions 4.2.16
WP versions 7.1.3
PHP versions 8.3.31, 8.4.26
SDK versions 3.3.66

Source: automated crash report — neve, fingerprint dd32a661da5a24e257d2836e290e0a41
Generated by bug-report-triage (ID: bug-report-triage_6ac883627ef247.03851758)

Lingua principale
PHP
Stelle
307
Fork
88
Merge medio
2g 21h
PR unite (30g)
15

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Codeinwp/neve

Tutte le issue di Codeinwp/neve

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.