Image URL replacement passes an integer cache token to the Optimole SDK

Read inc/url_replacer.php, especially normalize_image() and get_active_cache_booster(), then check the cache-token settings and transient handling in inc/settings.php. Run or extend the relevant tests in tests/test-replacer.php to cover an integer token. Done means the image-replacement path handles that case without passing an integer to the SDK’s string-typed parameter or causing the reported TypeError.

Summary

During image URL replacement, an integer cache token reaches the SDK method that creates an image, which requires a string. The resulting uncaught TypeError can interrupt frontend requests that resolve an image URL, including requests made while generating SEO image metadata.

Customer context

Product / area: Optimole WP image URL replacement
Version: Optimole WP 4.2.16; bundled Optimole PHP SDK 1.2.4
Environment: WordPress 7.1.3; PHP 8.4.26
Integration / third party: Rank Math image metadata resolution appears in the reported stack
Reported error / symptom: createImage() received an integer for $cacheBuster, which is typed as a string
Impact: 16 crash occurrences on 1 site in the report window; affected frontend requests can fail.

Reproduction notes

The reported stack shows Rank Math requesting an attachment image, followed by Optimole's image-downsize and URL replacement filters, where normalize_image() passes the active cache token to Optimole::image(). The production token value was not captured and the failure was not independently reproduced. An integer returned by the cache-token lookup is the reported failure condition.

Diagnosis

Conclusion

The product passes the result of its active-cache-token lookup directly into the Optimole SDK image factory. The getter can return a value stored in an individual-token transient or the main setting without a type check. The pinned SDK 1.2.4 source has a string-typed $cacheBuster parameter on createImage(), consistent with the production TypeError when the returned value is an integer. The source indicates the product boundary can pass through a non-string token; the production token's origin is unknown.

Where this likely occurs

• inc/url_replacer.php — Optml_Url_Replacer::normalize_image() approx. line 271 passes get_active_cache_booster() directly as the second argument to Optimole::image().
• inc/url_replacer.php — Optml_Url_Replacer::get_active_cache_booster() approx. lines 332–334 returns an individual transient entry or the supplied main cache-buster value without enforcing a string type.
• inc/settings.php — Optml_Settings::clear_cache() approx. lines 833–843 stores the API token in settings or the individual-token transient after checking that the token key exists.
• composer.lock — lines 10–15 pin codeinwp/optimole-sdk v1.2.4. Its upstream Optimole::createImage() declaration at the pinned source has a string-typed $cacheBuster parameter; the dependency's vendor directory is not present in this workspace clone.

Engineering notes

The reported request path is image URL replacement during Rank Math thumbnail resolution. The plugin's token getter documents a string return, but it returns stored values without validating their runtime type. The telemetry confirms an integer reached the strict SDK parameter; it does not identify whether the value originated in the API response, settings, or transient state. The shared SDK signature itself is consistent with the intended string contract.

Test coverage status

tests/test-replacer.php configures string cache-buster settings at approx. lines 142–143. No relevant coverage for integer individual cache tokens or the get_active_cache_booster() return type was found during inspection.

What to verify or explore next

• May be worth checking the reported cache-token value and how it entered the individual-token transient or main setting.
• If reproducible, checking image replacement with an integer token may confirm the failing path.
• The plugin's tests could be checked for behavior with API responses containing numeric token values.

Unknowns / follow-up

The production cache-token value and its origin are unavailable. The pinned dependency source was verified externally because its vendor code is not included in the workspace clone.

Confidence

Confidence: 84/100

Two defects are supported by the reported traces and source: the SDK reads cached post counts as an array despite a historical scalar-to-array transient schema change, and Optimole passes a dynamic cache token directly to a string-typed SDK method. The two missing-file crashes are not confirmed source defects: both target files exist in SDK 3.3.65 and the require is guarded by is_file(), pointing instead to runtime file availability or permissions. No open matching GitHub issues were found for the two confirmed defects.

Crash telemetry

Source: automated crash report — optimole-wp, fingerprint 07ac0ca5eb14b5c91e9cb74a0206ee4b
Generated by bug-report-triage (ID: bug-report-triage_6ad460f41a3711.50580606)