Code Quality: Ensure wp_filesize() always returns a non-negative-int.

A negative file size is clearly impossible, and the return value of 0 is already documented as being the error case.

* Values filtered by `pre_wp_filesize` and `wp_filesize` are cast to `int` if they are numeric.
* Non-numeric values returned by the `wp_filesize` filter are discarded in favor of zero.
* Negative values filtered by the `pre_wp_filesize` filter are treated the same as `null` (and do not short-circuit).
* Negative values returned by the `wp_filesize` filter are clamped to be at least zero.

Developed as part of WordPress#12611.
Follow-up to r52837, r52932.

Props westonruter, apermo.
See #65670, #64898.


git-svn-id: https://develop.svn.wordpress.org/trunk@62813 602fd350-edb4-49c9-b593-d223f7449a82

Author: westonruter

src/wp-includes/functions.php

@@ -3639,24 +3639,29 @@ function wp_get_ext_types() {
  * Wrapper for PHP filesize with filters and casting the result as an integer.
  *
  * @since 6.0.0
+ * @since 7.1.0 The return value is now ensured to always be greater than or equal to zero.
  *
  * @link https://www.php.net/manual/en/function.filesize.php
  *
  * @param string $path Path to the file.
  * @return int The size of the file in bytes, or 0 in the event of an error.
+ * @phpstan-return non-negative-int
  */
-function wp_filesize( $path ) {
+function wp_filesize( $path ): int {
 	/**
 	 * Filters the result of wp_filesize() before the file_exists() PHP function is run.
 	 *
 	 * @since 6.0.0
+	 * @since 7.1.0 Negative values are now ignored, being treated the same as null. Numeric values are cast to integers.
 	 *
-	 * @param null|int $size The unfiltered value. Returning an int from the callback bypasses the filesize call.
+	 * @param null|int $size The unfiltered value. Returning a non-negative number from the callback bypasses the filesize call.
 	 * @param string   $path Path to the file.
 	 */
 	$size = apply_filters( 'pre_wp_filesize', null, $path );
-
-	if ( is_int( $size ) ) {
+	if ( is_numeric( $size ) ) {
+		$size = (int) $size;
+	}
+	if ( is_int( $size ) && $size >= 0 ) {
 		return $size;
 	}
 
@@ -3666,11 +3671,18 @@ function wp_filesize( $path ) {
 	 * Filters the size of the file.
 	 *
 	 * @since 6.0.0
+	 * @since 7.1.0 The return value is now always zero or greater. Numeric values are cast to integers.
 	 *
 	 * @param int    $size The result of PHP filesize on the file.
 	 * @param string $path Path to the file.
 	 */
-	return (int) apply_filters( 'wp_filesize', $size, $path );
+	$size = apply_filters( 'wp_filesize', $size, $path );
+	if ( is_numeric( $size ) ) {
+		$size = (int) $size;
+	} else {
+		$size = 0;
+	}
+	return max( 0, $size );
 }
 
 /**

tests/phpunit/tests/functions/wpFilesize.php

@@ -9,46 +9,100 @@
  */
 class Tests_Functions_wpFilesize extends WP_UnitTestCase {
 
+	const TEST_FILE = DIR_TESTDATA . '/images/test-image-upside-down.jpg';
+
 	/**
 	 * @ticket 49412
 	 */
-	public function test_wp_filesize() {
-		$file = DIR_TESTDATA . '/images/test-image-upside-down.jpg';
-
-		$this->assertSame( filesize( $file ), wp_filesize( $file ) );
+	public function test_wp_filesize(): void {
+		$this->assertSame( filesize( self::TEST_FILE ), wp_filesize( self::TEST_FILE ) );
 	}
 
 	/**
 	 * @ticket 49412
+	 * @ticket 65670
 	 */
-	public function test_wp_filesize_filters() {
-		$file = DIR_TESTDATA . '/images/test-image-upside-down.jpg';
+	public function test_wp_filesize_filters(): void {
+		add_filter( 'wp_filesize', static fn () => 999 );
+		$this->assertSame( 999, wp_filesize( self::TEST_FILE ) );
 
-		add_filter(
-			'wp_filesize',
-			static function () {
-				return 999;
-			}
-		);
+		add_filter( 'wp_filesize', static fn () => '9991', 100 );
+		$this->assertSame( 9991, wp_filesize( self::TEST_FILE ) );
 
-		$this->assertSame( 999, wp_filesize( $file ) );
+		add_filter( 'pre_wp_filesize', static fn () => 111 );
+		$this->assertSame( 111, wp_filesize( self::TEST_FILE ) );
 
-		add_filter(
-			'pre_wp_filesize',
-			static function () {
-				return 111;
-			}
-		);
+		add_filter( 'pre_wp_filesize', static fn () => '2222', 100 );
+		$this->assertSame( 2222, wp_filesize( self::TEST_FILE ) );
 
-		$this->assertSame( 111, wp_filesize( $file ) );
+		add_filter( 'pre_wp_filesize', static fn () => -100, 200 );
+		$this->assertSame( 9991, wp_filesize( self::TEST_FILE ) );
 	}
 
 	/**
 	 * @ticket 49412
 	 */
-	public function test_wp_filesize_with_nonexistent_file() {
-		$file = 'nonexistent/file.jpg';
+	public function test_wp_filesize_with_nonexistent_file(): void {
+		$this->assertSame( 0, wp_filesize( 'nonexistent/file.jpg' ) );
+	}
+
+	/**
+	 * @ticket 65670
+	 */
+	public function test_wp_filesize_pre_wp_filesize_filter_null(): void {
+		add_filter( 'pre_wp_filesize', '__return_null' );
+
+		$this->assertSame( filesize( self::TEST_FILE ), wp_filesize( self::TEST_FILE ) );
+	}
 
-		$this->assertSame( 0, wp_filesize( $file ) );
+	/**
+	 * @ticket 65670
+	 *
+	 * @dataProvider data_wp_filesize_pre_wp_filesize_filter_negative
+	 *
+	 * @param float|int|string $value Negative value returned by the filter.
+	 */
+	public function test_wp_filesize_pre_wp_filesize_filter_negative( $value ): void {
+		add_filter( 'pre_wp_filesize', static fn () => $value );
+
+		$this->assertSame( filesize( self::TEST_FILE ), wp_filesize( self::TEST_FILE ) );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array<string, array{ 0: float|int|string }>
+	 */
+	public function data_wp_filesize_pre_wp_filesize_filter_negative(): array {
+		return array(
+			'negative int'            => array( -1 ),
+			'negative numeric string' => array( '-1' ),
+			'negative float'          => array( -1.5 ),
+		);
+	}
+
+	/**
+	 * @ticket 65670
+	 *
+	 * @dataProvider data_wp_filesize_filter_invalid_value
+	 *
+	 * @param mixed $value
+	 */
+	public function test_wp_filesize_wp_filesize_filter_invalid_value( $value ): void {
+		add_filter( 'wp_filesize', static fn () => $value );
+		$this->assertSame( 0, wp_filesize( self::TEST_FILE ) );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array<string, array{ 0: mixed }>
+	 */
+	public function data_wp_filesize_filter_invalid_value(): array {
+		return array(
+			'negative' => array( -1 ),
+			'null'     => array( null ),
+			'array'    => array( array( 'bad', 'array' ) ),
+		);
 	}
 }