Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Customizer responsive sanitizer fatals when input is an array

クローズ 初心者向け
  • 何か問題がありますか？
#4,651 コメント 2 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@HardeepAsrani がすでに取り組んでいます。

2026年10月9日 から。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
66/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
php, wordpress
領域
backend

調査の方向性

header-footer-grid/Traits/Core.php の sanitize_responsive_int_json()（77〜86行目付近）から始めてください。ここでは型チェックより前に json_decode($input, true) が実行されます。次に header-footer-grid/Core/Builder/Abstract_Builder.php のサニタイザー登録を確認してください。その後 tests/test-neve-sanitization.php を読んでください。このヘルパーはフィクスチャを JSON エンコードするため、ネイティブ配列の入力はテストされていません。完了条件は、ネイティブ配列で致命的エラーが発生しなくなること、シリアライズされた文字列の入力が従来どおりサニタイズされること、そして配列のケースをテストが網羅することです。

索引モデルが issue の本文から書いたものです。

説明

bug-report bug-report-triage crash-report

Summary

When a responsive Customizer setting is submitted as an array, the sanitizer can terminate the request with a TypeError instead of returning a sanitized value. This interrupts the affected Customizer preview request.

Customer context

Product / area: Neve, Header Footer Grid responsive Customizer settings
Version: Neve 4.2.16
Environment: WordPress 7.1.3; PHP 8.3.31 and 8.4.26
Integration / third party: Not identified as relevant
Reported error / symptom: json_decode(): Argument #1 ($json) must be of type string, array given
Impact: The fatal interrupts the affected Customizer preview request; two sites were represented in telemetry.

Reproduction notes

Production telemetry captured this during a frontend request in the Customizer preview/sanitization path on Neve 4.2.16. The exact responsive setting and submitted payload are not available. The source-level failure can be exercised by calling sanitize_responsive_int_json() with an array on a PHP version that rejects non-string input to json_decode(); no local runtime reproduction was performed.

Diagnosis

Conclusion

Confirmed product defect: production telemetry records an array reaching sanitize_responsive_int_json(), and the Neve 4.2.16 implementation passes that value directly to json_decode(). The reported TypeError matches this source path.

Where this likely occurs
  • header-footer-grid/Traits/Core.php — Abstract_Component::sanitize_responsive_int_json() approx. lines 77–86 calls json_decode($input, true) before validating the input type.
  • header-footer-grid/Core/Builder/Abstract_Builder.php — responsive setting registration approx. lines 400–402 attaches the sanitizer callback.
  • tests/test-neve-sanitization.php — do_assertion_for_sanitize_responsive_int_json() lines 241–243 JSON-encodes its array fixtures before invoking the sanitizer.
Engineering notes

The crash is reported for Neve 4.2.16 on PHP 8.3 and 8.4. The stack identifies the Customizer setting sanitization path, and the telemetry gives direct evidence that the callback received an array. Existing tests cover array-shaped values only after JSON encoding, not the native array input reported here. No regression boundary was identified; the method has existed since 2019.

Test coverage status

tests/test-neve-sanitization.php::test_sanitize_responsive_int_json() covers serialized JSON input, including fixtures initially represented as arrays. Its helper encodes those fixtures before the sanitizer call, so relevant native-array input coverage is absent from the inspected test path. No test suite was run.

What to verify or explore next
  • Reproduce the reported Customizer callback path with a native array input on the affected PHP versions.
  • Identify which responsive setting and client payload produce the array in the Customizer request.
  • Confirm behavior for existing serialized-string inputs alongside the reported native-array case.
Unknowns / follow-up

The exact setting identifier, request payload, and triggering user interaction were not captured in the telemetry report.

Confidence

Confidence: 98/100

The Neve 4.2.16 Customizer crash is confirmed by production telemetry and source: the sanitizer passes the reported array directly to json_decode(). The three loader fingerprints all resolve to an unguarded require in Neve 4.1.4/4.2.2/4.2.6, while v4.2.14 contains a missing-file guard, so those older-version signals do not warrant a new issue when a fixed release is available.

Crash telemetry
Occurrences 20
Distinct sites 2
First seen 2026-10-07 20:18 UTC
Last seen 2026-10-08 15:09 UTC
Crash location product:header-footer-grid/Traits/Core.php:78
Request context frontend
Inside Themeisle SDK no
Product versions 4.2.16
WP versions 7.1.3
PHP versions 8.3.31, 8.4.26
SDK versions 3.3.66

Source: automated crash report — neve, fingerprint dd32a661da5a24e257d2836e290e0a41
Generated by bug-report-triage (ID: bug-report-triage_6ac883627ef247.03851758)

主要言語
PHP
スター
307
フォーク
89
平均マージ
2日 14時間
マージ済み PR（30日）
24

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

Codeinwp/neve のほかの issue

Codeinwp/neve の issue をすべて見る

似ている issue

PHP の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。