Editor: Ignore theme.json values of unexpected types by ramonjd · Pull Request #14190 · WordPress/wordpress-develop

ramonjd · 2026-10-11T10:36:59Z

Trac ticket: https://core.trac.wordpress.org/ticket/66286

Backports WordPress/gutenberg#84523 and WordPress/gutenberg#84529

What

Stops WP_Theme_JSON from throwing fatal TypeErrors when theme.json or global styles data contains values of the wrong type.

Why

The Gutenberg report came from a live site where every front-end page fatalled:

PHP Fatal error: Uncaught TypeError: explode(): Argument #2 ($string) must be of type string, array given
#1 WP_Theme_JSON_Gutenberg::process_blocks_custom_css(Array, 'a:where(:not(.w...')
#2 WP_Theme_JSON_Gutenberg->get_styles_for_block(Array)

sanitize() keeps schema leaves such as css and spacingScale whatever their type, so an array css value reaches explode() in process_blocks_custom_css(). The same gap fatals in a few other places.

What changed

Values of unexpected types are now ignored instead of crashing:

css that isn't a string produces no output (the reported crash).
ref that isn't a string is ignored.
A spacingScale that isn't an array, or a spacingScale.unit that isn't a string, is ignored.
Shared block style variations that aren't arrays, and blockTypes items that aren't strings, are skipped.

Valid data is unaffected.

Each case has a test. All nine new cases fail on trunk with a TypeError.

github-actions · 2026-10-11T10:37:08Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props ramonopoly, andrewserong, aaronrobertshaw.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-10-11T10:40:14Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

andrewserong

This is smoke testing well for me, adds some good hardening IMO, and is a faithful backport of the GB PR.

LGTM!

ramonjd · 2026-10-12T03:16:59Z

+			$base_spacing_scale = _wp_array_get( $this->theme_json, $scale_path, array() );
+			if ( is_array( $base_spacing_scale ) ) {
+				$flattened_spacing_scale = array_replace( $flattened_spacing_scale, $base_spacing_scale );
+			}

 			$spacing_scale = _wp_array_get( $incoming_data, $scale_path, null );
-			if ( ! isset( $spacing_scale ) ) {
+			if ( ! is_array( $spacing_scale ) ) {


Backports WordPress/gutenberg#84529

cc @aaronrobertshaw

aaronrobertshaw

This is looking pretty close to me 👍

✅ Matches #84523 and #84529
✅ New test cases are easy to follow

There are only a couple of things I noticed this time around:

The root styles.css guard in get_stylesheet() is the only new check without a test.

Maybe we could we add a root case to the new data provider?

E.g. array( 'styles' => array( 'css' => array( 'color' => 'red' ) ) )

The last one is pretty minor but the deprecated get_custom_css() still reads root styles.css without a type check. An array there would still trigger a warning.

Prevents `WP_Theme_JSON` from throwing fatal `TypeError`s when theme.json or global styles data contains values of the wrong type. Sanitization keeps schema leaves such as `css` and `spacingScale` whatever their type, so, for example, an array `css` value reached `explode()` in `process_blocks_custom_css()`. Values of unexpected types are now ignored: non-string `css` and `ref` values, a non-array `spacingScale` or non-string `spacingScale.unit`, shared block style variations that are not arrays, and `blockTypes` items that are not strings. Backports WordPress/gutenberg#84523. See #66286.

Backports WordPress/gutenberg@ba8f807c5f from WordPress/gutenberg#84523. See #66286.

…ging. `WP_Theme_JSON::merge()` passed per-origin `spacingScale` values straight to `array_replace()`, so a scale such as `{ "theme": "1.5" }` caused a fatal `TypeError`. Base and incoming per-origin spacing scales that are not arrays are now skipped. Backports WordPress/gutenberg#84529. See #66286.

Adds a root `styles.css` case to the unexpected types data provider and requests the `custom-css` type from `get_stylesheet()`, which the root custom CSS check only runs for. See #66286.

This commit prevents `WP_Theme_JSON` from throwing fatal TypeErrors when theme.json or global styles data contains values of the wrong type. Those values could be user- or AI-generated. The checks in this commit cover spacing scale arrays, block variation selectors, and custom block CSS processing. The motivation arose from a real-life PHP fatal where `WP_Theme_JSON::process_blocks_custom_css` attempted to explode a non-string. Developed in: #14190 Props ramonopoly, aaronrobertshaw, andrewserong. Fixes #66286. git-svn-id: https://develop.svn.wordpress.org/trunk@64309 602fd350-edb4-49c9-b593-d223f7449a82

github-actions · 2026-10-12T08:19:18Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 64309
GitHub commit: b1bfeaf

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

This commit prevents `WP_Theme_JSON` from throwing fatal TypeErrors when theme.json or global styles data contains values of the wrong type. Those values could be user- or AI-generated. The checks in this commit cover spacing scale arrays, block variation selectors, and custom block CSS processing. The motivation arose from a real-life PHP fatal where `WP_Theme_JSON::process_blocks_custom_css` attempted to explode a non-string. Developed in: WordPress/wordpress-develop#14190 Props ramonopoly, aaronrobertshaw, andrewserong. Fixes #66286. Built from https://develop.svn.wordpress.org/trunk@64309 git-svn-id: http://core.svn.wordpress.org/trunk@63459 1a063a9b-81f0-0310-95a4-ce76da25c4cd

ramonjd self-assigned this Oct 11, 2026

ramonjd added the enhancement label Oct 11, 2026

andrewserong approved these changes Oct 12, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 12, 2026

PHP backports for WP 7.2 WordPress/gutenberg#83761

Open

ramonjd commented Oct 12, 2026

View reviewed changes

aaronrobertshaw approved these changes Oct 12, 2026

View reviewed changes

aaronrobertshaw mentioned this pull request Oct 12, 2026

Global Styles: Ignore per-origin spacingScale values that are not objects WordPress/gutenberg#84529

Merged

ramonjd added 4 commits October 12, 2026 17:34

Editor: Only output root custom CSS when it is a string.

e632387

Backports WordPress/gutenberg@ba8f807c5f from WordPress/gutenberg#84523. See #66286.

Editor: Test that non-string root custom CSS is ignored.

f73b2da

Adds a root `styles.css` case to the unexpected types data provider and requests the `custom-css` type from `get_stylesheet()`, which the root custom CSS check only runs for. See #66286.

ramonjd force-pushed the fix/theme-json-non-string-values branch from f915516 to f73b2da Compare October 12, 2026 06:34

github-actions Bot closed this Oct 12, 2026

andrewserong mentioned this pull request Oct 12, 2026

Global Styles: Ignore theme.json values of unexpected types WordPress/gutenberg#84523

Merged

Navigation Menu

Repository navigation

Editor: Ignore theme.json values of unexpected types - #14190

Editor: Ignore theme.json values of unexpected types#14190
ramonjd wants to merge 4 commits into
WordPress:trunkfrom
ramonjd:fix/theme-json-non-string-values

ramonjd commented Oct 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 11, 2026

Uh oh!

andrewserong left a comment

Uh oh!

ramonjd Oct 12, 2026

Uh oh!

aaronrobertshaw left a comment

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ramonjd commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

What changed

Uh oh!

github-actions Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 11, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

andrewserong left a comment

Choose a reason for hiding this comment

Uh oh!

ramonjd Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

aaronrobertshaw left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ramonjd commented Oct 11, 2026 •

edited

Loading

github-actions Bot commented Oct 11, 2026 •

edited

Loading