REST API: Normalize non-integer attachment filesize metadata by apermo · Pull Request #12611 · WordPress/wordpress-develop

apermo · 2026-07-20T11:34:21Z

Trac ticket

https://core.trac.wordpress.org/ticket/65670

Problem

WP_REST_Attachments_Controller::get_attachment_filesize() (new in 7.0.0) returns the filesize value from attachment metadata verbatim against a strict ?int return type. Attachment metadata is untyped postmeta, so a non-numeric string value throws a fatal TypeError when the media endpoint is requested:

TypeError: WP_REST_Attachments_Controller::get_attachment_filesize():
Return value must be of type ?int, string returned

A numeric string only survives because the file has no strict_types declaration (coercion). A non-numeric one fatals.

Plugins populate filesize from remote storage API responses — e.g. the Google Drive fileSize field (returned as a string) via WP Media Folder, and the equivalent Dropbox/OneDrive addons — so this occurs on real sites.

Fix

Only return the stored value when it is numeric, cast to int; otherwise fall through to recompute the size from the file via wp_filesize() (which always casts to int), returning null if unavailable. This matches the 'type' => 'integer' REST schema.

Testing

Two regression tests added to tests/phpunit/tests/rest-api/rest-attachments-controller.php:

numeric-string filesize meta → normalized to int in the response;
non-numeric filesize meta → no fatal, falls back to the real file size.

The non-numeric test reproduces the reported TypeError against unpatched trunk (red), and passes with the fix (green).

Disclosure

Claude (Anthropic) assisted in diagnosing the root cause and drafting the patch and tests. I reviewed the change, verified the red/green test behavior locally, and take responsibility for it.

Attachment metadata is untyped, so `filesize` can be stored as a string (for example, plugins that populate it from a remote storage API response such as the Google Drive `fileSize` field, which the API returns as a string). Returning it verbatim violated the `?int` return type of `WP_REST_Attachments_Controller::get_attachment_filesize()` and caused a fatal TypeError for non-numeric values. Only return the stored value when numeric, casting to int; otherwise fall through to recompute the size from the file via wp_filesize(). Fixes https://core.trac.wordpress.org/ticket/65670 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

github-actions · 2026-07-20T11:34:32Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props apermo, westonruter, xate, mukesh27.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

apermo · 2026-07-20T11:34:46Z

@westonruter would you be able to review this? It fixes a fatal TypeError in get_attachment_filesize() (new in 7.0.0) when filesize attachment metadata is stored as a non-numeric string — which happens on sites using plugins that populate it from remote storage APIs (e.g. the Google Drive fileSize string via WP Media Folder). Trac: https://core.trac.wordpress.org/ticket/65670

apermo · 2026-07-20T11:36:37Z

@westonruter Would you be so kind to have a look at it? Thanks :)

xateman

Looks good 👍

github-actions · 2026-07-20T11:39:27Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

Shorten the inline comment in get_attachment_filesize() to the essential rationale, per PR review feedback. See https://core.trac.wordpress.org/ticket/65670 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…HPStan issues in tests

Copilot

Pull request overview

This PR fixes a REST API fatal error in WP_REST_Attachments_Controller::get_attachment_filesize() by ensuring attachment filesize metadata (which is untyped postmeta) is normalized to an integer (or recomputed) before being returned under a strict ?int return type.

Changes:

Normalize numeric filesize metadata to an int, and fall back to recomputing the file size when metadata is not usable.
Add REST API regression tests covering numeric-string and non-numeric filesize metadata cases.
Add an extra sanity assertion in an existing attachment REST test to ensure the factory returns an integer attachment ID.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
tests/phpunit/tests/rest-api/rest-attachments-controller.php	Adds regression tests validating `filesize` normalization and non-numeric recovery behavior.
src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php	Hardens `get_attachment_filesize()` by validating/casting stored metadata before returning it.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Refine the filesize metadata guard per PR review: accept only a positive integer (an int or a digit-only string), rather than any numeric value. This avoids silently truncating float strings such as '123.4' via the int cast, and rejects zero and negative values, falling through to recompute the size from the file in those cases. Also document the method's positive-integer return with a @phpstan-return non-negative-int|null annotation. See https://core.trac.wordpress.org/ticket/65670 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Attachment metadata is untyped, so `filesize` may be a float, bool or other non-string scalar. Passing such a value to ctype_digit() is fragile (deprecated in PHP 8.1+), so guard the call with is_string(); non-string scalars now fall through to recompute the size from the file. Extend the invalid-value data provider with float and boolean cases. See https://core.trac.wordpress.org/ticket/65670 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

westonruter · 2026-07-21T07:25:19Z

I fixed the typing of this function as otherwise get_attachment_filesize() would not be guaranteed to return a non-negative-int. This would warrant additional tests to ensure negative values get increased to zero.

Could there be any reason any plugin would filter pre_wp_filesize or wp_filesize to be negative?

Besides the obvious "Developer did a bad job, or had some quirky idea"?

I don't think so, but that alone is already bad enough.

No technically legitimate reason, but definitely a reason.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

… work

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

tests/phpunit/tests/rest-api/rest-attachments-controller.php:1026

wp_update_attachment_metadata() replaces the entire attachment metadata array. In this test, passing array( 'filesize' => ... ) wipes any existing metadata keys (e.g. width/height/sizes), which can make the test less representative and may hide issues in response preparation. Consider merging into the existing metadata (or an empty array if none exists) and updating only the filesize key.

		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => '123456' ) );

tests/phpunit/tests/rest-api/rest-attachments-controller.php:1057

wp_update_attachment_metadata() overwrites the full metadata array, so setting only filesize here discards any existing keys and can make the test less realistic. Prefer reading the current metadata (or using an empty array) and updating only the filesize entry before writing it back.

		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => $filesize ) );

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

westonruter · 2026-07-21T20:02:33Z

+			(
+				is_int( $meta['filesize'] ) ||
+				( is_string( $meta['filesize'] ) && ctype_digit( $meta['filesize'] ) )
+			) &&


In reality, I think going through all this is overkill.

Suggested change

(

is_int( $meta['filesize'] ) ||

( is_string( $meta['filesize'] ) && ctype_digit( $meta['filesize'] ) )

) &&

is_numeric( $meta['filesize'] ) &&

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

xateman approved these changes Jul 20, 2026

View reviewed changes

xateman reviewed Jul 20, 2026

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

apermo and others added 2 commits July 20, 2026 13:41

docs(rest): trim filesize guard comment per review

ba9bf73

Shorten the inline comment in get_attachment_filesize() to the essential rationale, per PR review feedback. See https://core.trac.wordpress.org/ticket/65670 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Eliminate legacy args for create_object() and add assertions to fix P…

dfb925e

…HPStan issues in tests

Copilot AI review requested due to automatic review settings July 21, 2026 02:58

Copilot started reviewing on behalf of westonruter July 21, 2026 02:58 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

mukeshpanchal27 reviewed Jul 21, 2026

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php Outdated

mukeshpanchal27 reviewed Jul 21, 2026

View reviewed changes

Comment thread tests/phpunit/tests/rest-api/rest-attachments-controller.php

Copilot AI review requested due to automatic review settings July 21, 2026 06:32

Copilot started reviewing on behalf of apermo July 21, 2026 06:33 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php Outdated

Comment thread tests/phpunit/tests/rest-api/rest-attachments-controller.php

Copilot AI review requested due to automatic review settings July 21, 2026 06:39

Copilot started reviewing on behalf of apermo July 21, 2026 06:39 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

westonruter added 5 commits July 21, 2026 00:09

Remove change to unrelated test

12a4efa

Add typing to data provider

6d2882e

Remove extra line break

be49854

Ensure wp_filesize() never returns a negative number

d27aa4b

Reformat multi-line conditional

a6810a9

Copilot AI review requested due to automatic review settings July 21, 2026 07:23

Copilot started reviewing on behalf of westonruter July 21, 2026 07:23 View session

westonruter reviewed Jul 21, 2026

View reviewed changes

Copilot AI reviewed Jul 21, 2026

View reviewed changes

westonruter added 4 commits July 21, 2026 10:37

Merge branch 'trunk' into trac-65670-attachment-filesize-typeerror

e87ede8

Make it clear a non-negative-int is required for the short-circuit to…

b6280e0

… work

Only cast numeric values to integer; treat others as zero

97bef96

Add tests

32585a8

Copilot AI review requested due to automatic review settings July 21, 2026 19:44

Copilot started reviewing on behalf of westonruter July 21, 2026 19:45 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread tests/phpunit/tests/functions/wpFilesize.php Outdated

Comment thread tests/phpunit/tests/functions/wpFilesize.php Outdated

Improve formatting of arrow functions

554a036

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 21, 2026 19:50

Copilot started reviewing on behalf of westonruter July 21, 2026 19:51 View session

Update filesize key in metadata alone

62be93a

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Use attachment's resolved path

001ee72

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 21, 2026 19:57

Copilot started reviewing on behalf of westonruter July 21, 2026 19:58 View session

westonruter reviewed Jul 21, 2026

View reviewed changes

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Uh oh!

Conversation

apermo commented Jul 20, 2026

Trac ticket

Problem

Fix

Testing

Disclosure

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

apermo commented Jul 20, 2026

Uh oh!

apermo commented Jul 20, 2026

Uh oh!

xateman left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 20, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

westonruter Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

apermo Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

apermo Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

westonruter Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

github-actions Bot commented Jul 20, 2026 •

edited

Loading