From 97790af164b20a72640b3497af4c5a3986d8cf32 Mon Sep 17 00:00:00 2001
From: Tonya Mork <hellofromtonya@git.wordpress.org>
Date: Wed, 15 Sep 2021 22:18:36 +0000
Subject: [PATCH] Options, Meta APIs: Fix "passing null to non-nullable"
 deprecations to `(get|add|update|delete)_option()`.

In all four of the `get_option()`, `add_option()`, `update_option()` and `delete_option()` functions, the `$option` parameter (i.e. the option name) is passed to the PHP native `trim()` function without prior input validation.

In PHP 8.1, this could lead to a `trim(): Passing null to parameter #1 ($string) of type string is deprecated` for each of these functions.

`trim()`:

- expects a text string and is only useful when ''passed'' a text string as no other variable type can contain whitespace.
- will always return a `string`, which means that in practice for any non-string values passed, it would effectively function as a type cast to string.

This commit:
- Adds a check to verify the `$option` name is a scalar before processing it with `trim()`.
- The "type cast" behavior is maintained.
- If the given `$option` name is not a scalar, such as `null`, the fix prevents the PHP 8.1 deprecation notice.
- Tests are added for valid but undesired option names to safeguard against regressions.

This issue is already covered by:
- the existing `Tests_Option_Option::test_bad_option_names()` test group.
- the new `test_valid_but_undesired_option_names()` tests.

Follow-up to [13858], [22633], [23510], [25002], [51817].

Props jrf, hellofromTonya, pbearne.
See #53635.

git-svn-id: https://develop.svn.wordpress.org/trunk@51818 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/option.php            | 20 +++++++--
 tests/phpunit/tests/option/option.php | 60 +++++++++++++++++++++++++++
 2 files changed, 76 insertions(+), 4 deletions(-)

diff --git a/src/wp-includes/option.php b/src/wp-includes/option.php
index ec41b060ae..dc2195949f 100644
--- a/src/wp-includes/option.php
+++ b/src/wp-includes/option.php
@@ -77,7 +77,10 @@
 function get_option( $option, $default = false ) {
 	global $wpdb;
 
-	$option = trim( $option );
+	if ( is_scalar( $option ) ) {
+		$option = trim( $option );
+	}
+
 	if ( empty( $option ) ) {
 		return false;
 	}
@@ -378,7 +381,10 @@ function wp_load_core_site_options( $network_id = null ) {
 function update_option( $option, $value, $autoload = null ) {
 	global $wpdb;
 
-	$option = trim( $option );
+	if ( is_scalar( $option ) ) {
+		$option = trim( $option );
+	}
+
 	if ( empty( $option ) ) {
 		return false;
 	}
@@ -565,7 +571,10 @@ function add_option( $option, $value = '', $deprecated = '', $autoload = 'yes' )
 		_deprecated_argument( __FUNCTION__, '2.3.0' );
 	}
 
-	$option = trim( $option );
+	if ( is_scalar( $option ) ) {
+		$option = trim( $option );
+	}
+
 	if ( empty( $option ) ) {
 		return false;
 	}
@@ -687,7 +696,10 @@ function add_option( $option, $value = '', $deprecated = '', $autoload = 'yes' )
 function delete_option( $option ) {
 	global $wpdb;
 
-	$option = trim( $option );
+	if ( is_scalar( $option ) ) {
+		$option = trim( $option );
+	}
+
 	if ( empty( $option ) ) {
 		return false;
 	}
diff --git a/tests/phpunit/tests/option/option.php b/tests/phpunit/tests/option/option.php
index 79331f9a24..a2145f1c18 100644
--- a/tests/phpunit/tests/option/option.php
+++ b/tests/phpunit/tests/option/option.php
@@ -148,6 +148,66 @@ class Tests_Option_Option extends WP_UnitTestCase {
 		);
 	}
 
+	/**
+	 * @ticket 53635
+	 *
+	 * @dataProvider data_valid_but_undesired_option_names
+	 *
+	 * @param mixed $option_name Option name.
+	 */
+	public function test_get_option_valid_but_undesired_option_names( $option_name ) {
+		$this->assertFalse( get_option( $option_name ) );
+	}
+
+	/**
+	 * @ticket 53635
+	 *
+	 * @dataProvider data_valid_but_undesired_option_names
+	 *
+	 * @param mixed $option_name Option name.
+	 */
+	public function test_add_option_valid_but_undesired_option_names( $option_name ) {
+		$this->assertTrue( add_option( $option_name, '' ) );
+	}
+
+	/**
+	 * @ticket 53635
+	 *
+	 * @dataProvider data_valid_but_undesired_option_names
+	 *
+	 * @param mixed $option_name Option name.
+	 */
+	public function test_update_option_valid_but_undesired_option_names( $option_name ) {
+		$this->assertTrue( update_option( $option_name, '' ) );
+	}
+
+	/**
+	 * @ticket 53635
+	 *
+	 * @dataProvider data_valid_but_undesired_option_names
+	 *
+	 * @param mixed $option_name Option name.
+	 */
+	public function test_delete_option_valid_but_undesired_option_names( $option_name ) {
+		$this->assertFalse( delete_option( $option_name ) );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array
+	 */
+	public function data_valid_but_undesired_option_names() {
+		return array(
+			'string 123'   => array( '123' ),
+			'integer 123'  => array( 123 ),
+			'integer -123' => array( -123 ),
+			'float 12.3'   => array( 12.3 ),
+			'float -1.23'  => array( -1.23 ),
+			'boolean true' => array( true ),
+		);
+	}
+
 	/**
 	 * @ticket 23289
 	 */