Repository navigation
Conversation
This update includes the following fixes: - Decompressing a compressed ID3v2 frame is now capped at a quarter of the memory limit, or 32 MB when the limit is unknown (GHSA-c2xw-vp6w-gpph). - The QuickTime `stsd`, `dref`, `elst` and `keys` atom parsers no longer trust entry counts larger than the atom's data can hold, which prevents memory exhaustion from crafted files (GHSA-4pp3-6hmx-mfmg). - On PHP < 8.0, `getid3_lib::XML2array()` refuses to parse XML if external entity loading cannot be disabled (GHSA-j649-xr34-mmmh). - Embedded pictures are no longer passed through character set conversion, which corrupted them. - The ID3v2 involved people (IPL, IPLS and TIPL) and musician credits (TMCL) frames are now parsed consistently into role and person pairs. - `replaygain_album_peak` is copied from TXXX frames to the main replay gain data. None of the changes are needed for PHP 8.6 compatibility. As in previous updates, only the audio and video subset of the library that WordPress bundles is updated. All 18 bundled files remain identical to the upstream release. References: * [https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.27 getID3 1.9.27 release notes] * [https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.28 getID3 1.9.28 release notes] * [JamesHeinrich/getID3@v1.9.26...v1.9.28 Full list of changes in getID3 1.9.27 and 1.9.28] Follow-up to r47601, r48278, r52254, r54376, r56975, r61253, r61889, r62087, r63520. Props desrosj. See #00000. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011Y86gx1T9qpKZuJWesSGiZ
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
desrosj
added
the
props-bot
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the bundled getID3 library from 1.9.26 to 1.9.28, which includes 1.9.27.
Trac ticket: https://core.trac.wordpress.org/ticket/66646
Changes
This applies bug fixes and hardening improvements.
How this follows previous updates
license.txtandreadme.txt) were identical to upstream v1.9.26, so there are no local patches to carry forward. After it, all 18 are identical to upstream v1.9.28. Only 4 files changed:getid3.php,getid3.lib.php,module.audio-video.quicktime.phpandmodule.tag.id3v2.php.phpcompat.xml.distmatch on file path, so they still apply.phpcs.xml.distexcludessrc/wp-includes/ID3/entirely.Behavior change for reviewers
wp_add_id3_tag_data()storesreset( $list )for each key in$data['id3v2']['comments']. #510 changes the shape of two of those keys:involved_people_list(IPL and IPLS) used to be a list containing one array of pairs, so WordPress stored every pair. It's now the array of pairs itself, soreset()stores only the firstarray( 'position' => …, 'person' => … )pair.involved_people_list(TIPL) andmusician_credits_list(TMCL) in ID3v2.4 tags used to be parsed as plain text frames. They are now parsed into the same pairs.This only affects attachment metadata for audio files that have these frames, and it's displayed nowhere in core. It may be worth keeping the old shape for these keys in
wp_add_id3_tag_data(), or deciding it's acceptable.Testing
php -lon all bundled files: passes. Run on PHP 8.6.0-dev.vendor/bin/phpcs --standard=phpcompat.xml.dist src/wp-includes/ID3/: clean.wp_read_audio_metadata()andwp_read_video_metadata()tests intests/phpunit/tests/media.php.Use of AI Tools
wp_add_id3_tag_data(), running the checks above, and drafting this description. I reviewed the result.🤖 Generated with Claude Code
https://claude.ai/code/session_011Y86gx1T9qpKZuJWesSGiZ
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.