Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

VideoPress shortcode fatals due to unsanitized filtered input. #40766

Closed
zinigor opened this issue Dec 30, 2024 · 2 comments · Fixed by #40790
Closed

VideoPress shortcode fatals due to unsanitized filtered input. #40766

zinigor opened this issue Dec 30, 2024 · 2 comments · Fixed by #40790
Assignees
@tbradsha
Labels
[Experiment] AI labels added [Feature] Error Reporting [Feature Group] Content Management Features related to the tools and screens that admins use to manage their sites core content. [Feature] VideoPress A feature to help you upload and insert videos on your site. Needs triage Ticket needs to be triaged [Platform] Atomic [Plugin] Jetpack Issues about the Jetpack plugin. https://wordpress.org/plugins/jetpack/ [Pri] Low [Status] Auto-allocated [Type] Bug When a feature is broken and / or not performing as intended

Comments

@zinigor
Copy link
Member

zinigor commented Dec 30, 2024

Impacted plugin

Jetpack

Quick summary

This is probably happening because of some filtered input that we're not expecting in the shortcode.

Steps to reproduce

Not sure how to reproduce it besides just adding a filer that uses the same data that's visible from error logs.

A clear and concise description of what you expected to happen.

No response

What actually happened

No response

Impact

Some (< 50%)

Available workarounds?

Yes, easy to implement

If the above answer is "Yes...", outline the workaround.

No response

Platform (Simple and/or Atomic)

Atomic, Self-hosted

Logs or notes

PHP Fatal error:  Uncaught TypeError: Unsupported operand types: string % int in /wordpress/plugins/jetpack/14.2-a.3/modules/videopress/shortcode.php:136
Stack trace:
#0 /wordpress/plugins/jetpack/14.2-a.3/modules/videopress/shortcode.php(249): VideoPress_Shortcode->shortcode_callback(Array)
#1 /wordpress/core/6.7.1/wp-includes/class-wp-hook.php(324): VideoPress_Shortcode->video_shortcode_override('', Array, '', 1)
#2 /wordpress/core/6.7.1/wp-includes/plugin.php(205): WP_Hook->apply_filters('', Array)
#3 /wordpress/core/6.7.1/wp-includes/media.php(3597): apply_filters('wp_video_shortc...', '', Array, '', 1)
#4 /wordpress/core/6.7.1/wp-includes/shortcodes.php(434): wp_video_shortcode(Array, '', 'video')
#5 [internal function]: do_shortcode_tag(Array)
#6 /wordpress/core/6.7.1/wp-includes/shortcodes.php(273): preg_replace_callback('/\\[(\\[?)(video)...', 'do_shortcode_ta...', '<blockquote>\n<p...')
#7 /wordpress/core/6.7.1/wp-includes/class-wp-hook.php(324): do_shortcode('<blockquote>\n<p...')
#8 /wordpress/core/6.7.1/wp-includes/plugin.php(205): WP_Hook->apply_filters('<blockquote>\n<p...', Array)
#9 /wordpress/core/6.7.1/wp-includes/formatting.php(3965): apply_filters('the_content', '<blockquote><p>...')
#10 /wordpress/core/6.7.1/wp-includes/class-wp-hook.php(324): wp_trim_excerpt('<blockquote><p>...', Object(WP_Post))
#11 /wordpress/core/6.7.1/wp-includes/plugin.php(205): WP_Hook->apply_filters('', Array)
#12 /wordpress/core/6.7.1/wp-includes/post-template.php(436): apply_filters('get_the_excerpt', '', Object(WP_Post))
#13 /srv/htdocs/wp-content/themes/alchemists/template-parts/content-blog-1.php(62): get_the_excerpt()
#14 /wordpress/core/6.7.1/wp-includes/template.php(812): require('/srv/htdocs/wp-...')
#15 /wordpress/core/6.7.1/wp-includes/template.php(745): load_template('/srv/htdocs/wp-...', false, Array)
#16 /wordpress/core/6.7.1/wp-includes/general-template.php(206): locate_template(Array, true, false, Array)
#17 /srv/htdocs/wp-content/themes/alchemists/index.php(379): get_template_part('template-parts/...', 'blog-1')
#18 /wordpress/core/6.7.1/wp-includes/template-loader.php(106): include('/srv/htdocs/wp-...')
#19 /wordpress/core/6.7.1/wp-blog-header.php(19): require_once('/wordpress/core...')
#20 /wordpress/core/6.7.1/index.php(17): require('/wordpress/core...')
#21 {main}
  thrown in /wordpress/plugins/jetpack/14.2-a.3/modules/videopress/shortcode.php on line 136
@zinigor zinigor added [Type] Bug When a feature is broken and / or not performing as intended Needs triage Ticket needs to be triaged labels Dec 30, 2024
@github-actions github-actions bot added [Plugin] Jetpack Issues about the Jetpack plugin. https://wordpress.org/plugins/jetpack/ [Platform] Atomic [Pri] Low [Feature Group] Content Management Features related to the tools and screens that admins use to manage their sites core content. [Feature] Error Reporting [Feature] VideoPress A feature to help you upload and insert videos on your site. labels Dec 30, 2024
@github-actions GitHub Actions
Copy link
Contributor

OpenAI suggested the following labels for this issue:

  • [Feature Group] Content Management: The issue relates to managing content through the Jetpack plugin, specifically with handling shortcodes.
  • [Feature] VideoPress: This issue is directly linked to the VideoPress feature, which is causing PHP fatal errors due to unsanitized filtered input.
  • [Feature] Error Reporting: There is a fatal error being reported in the logs, indicating a critical need for error handling related to the functionality affected.

@github-actions GitHub Actions
Copy link
Contributor

This issue could use some more labels, to help prioritize and categorize our work. Could you please add at least a [Type], a [Feature], and a [Pri] label?

@tbradsha tbradsha mentioned this issue Dec 31, 2024
Merged
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tbradsha tbradsha

Labels
[Experiment] AI labels added [Feature] Error Reporting [Feature Group] Content Management Features related to the tools and screens that admins use to manage their sites core content. [Feature] VideoPress A feature to help you upload and insert videos on your site. Needs triage Ticket needs to be triaged [Platform] Atomic [Plugin] Jetpack Issues about the Jetpack plugin. https://wordpress.org/plugins/jetpack/ [Pri] Low [Status] Auto-allocated [Type] Bug When a feature is broken and / or not performing as intended
Projects
Automattic Prioritization: The One Board ™
Status: Done 🎉
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Resolves #40766 - Prevent TypeError in VideoPress shortcode Automattic/jetpack
3 participants
@zinigor @matticbot @tbradsha