Skip to content

Content query: parse IDs and integer filters as schema validation does - #1075

Closed
jorgefilipecosta wants to merge 2 commits into
developfrom
fix/content-query-integer-ids
Closed

jorgefilipecosta wants to merge 2 commits into
developfrom
fix/content-query-integer-ids

Conversation

@jorgefilipecosta

@jorgefilipecosta jorgefilipecosta commented Sep 29, 2026 •

Copy link
Copy Markdown
Member

What?

Makes core/content-query read its id input and its author and parent filters the way the input schema validates integers.

Why?

The input schema declares these as integers, and the JSON Schema integer type accepts whole floats and numeric strings such as "12.0" or "+12". The execute side read them differently:

  • The author and parent filters accepted only native integers and digit strings, so {"author": "12.0"} passed validation and then failed with content_invalid_filter.
  • The id went through absint(). A whole float beyond the integer range passes validation, and the cast wraps it around, so an ID of 2^64 + 4194304 read post 4194304. The permission check resolved the same post, so read permissions still applied, but the ability returned a post the caller did not ask for. In a direct call to the execute callback, a non-numeric ID became 0, and get_post( 0 ) falls back to the global post.

This came up in the review of #1025, whose write abilities parse their IDs with the same helper. That PR leaves the read ability as it is, so the change lands here.

How?

  • parse_filter_int() accepts a value when rest_is_integer() does, as schema validation does, and rejects a float at or beyond PHP_INT_MAX before casting it.
  • check_permission() and execute_content_query() parse the id with it, and skip the lookup when the ID is invalid.

Testing Instructions

Run the content ability tests:

npm run test:php -- --filter ContentTest

Both new tests fail on develop:

  • test_author_filter_accepts_every_integer_form fails with "An author filter given as a whole float should be honored."
  • test_get_by_id_beyond_the_integer_range_is_denied fails with "An ID beyond the integer range should not resolve a post.", because the lookup returns post 4194304.

Changelog Entry

Fixed - The content query ability accepts every integer form its schema allows for the author and parent filters, and no longer resolves an ID beyond the integer range to another post.

Open WordPress Playground Preview

The JSON Schema integer type accepts whole floats and numeric strings such
as "12.0" or "+12", so an author or parent filter given that way passes
validation and was then rejected as an invalid filter. Parse the value
with rest_is_integer(), as validation does, and reject a value beyond the
integer range, which a cast would wrap around onto an unrelated ID.
A whole float beyond the integer range passes the schema's integer
validation, and absint() wrapped it around, so an ID of 2^64 + N read
post N. Parse the ID like the filters, which rejects such a value, and
skip the lookup when the ID is invalid so get_post() never falls back to
the global post.
@codecov

codecov Bot commented Sep 29, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.54%. Comparing base (a880957) to head (e466faf).

Additional details and impacted files
@@            Coverage Diff             @@
##             develop    #1075   +/-   ##
==========================================
  Coverage      81.53%   81.54%           
- Complexity      3071     3072    +1     
==========================================
  Files            129      129           
  Lines          12253    12255    +2     
==========================================
+ Hits            9991     9993    +2     
  Misses          2262     2262           
Flag Coverage Δ
unit 81.54% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions

Copy link
Copy Markdown

✅ WordPress Plugin Check Report

✅ Status: Passed

📊 Report

All checks passed! No errors or warnings found.


🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant