(latest-posts) Blank category passed to array_column causes PHP warning and possibly other unwanted side-effects

[fullofcaffeine]

Description

We've been noticing quite a few warnings in a large multisite instance (WordPress.com) with the following message:

array_column() expects parameter 1 to be array, string given

It originates from this line https://github.com/WordPress/gutenberg/blame/trunk/packages/block-library/src/latest-posts/index.php#L60 and happens because @attributes['categories'] is a blank string instead of the expected array of categories. Here's a dump of $attributes from one of the affected sites.

The bug manifests itself as a warning being output in place of the latest-posts widget 😬 . The warning array_column() expects parameter 1 to be array, string given is printed verbatim where the widget was supposed to render. The $attributes array looks like this in this case:

Array
(
    [categories] => 
    [postsToShow] => 3
    [displayPostContent] => 1
    [displayPostDate] => 1
    [displayPostContentRadio] => excerpt
    [excerptLength] => 55
    [displayAuthor] => 
    [postLayout] => list
    [columns] => 3
    [order] => desc
    [orderBy] => date
    [displayFeaturedImage] => 
    [featuredImageSizeSlug] => thumbnail
    [addLinkToFeaturedImage] => 
)

Normally, if categories are not set for the block, then it won't include the categories attribute as part of the array, but in this case, for some reason it does. This corruption seems to happen when the block widget is saved (more details here).

Here's the stacktrace from one of the sites:

1. `/plugins/gutenberg-core/v16.3.0/build/block-library/blocks/latest-posts.php:60` - `array_column()`
2. `wp-includes/class-wp-block.php:263` - `gutenberg_render_block_core_latest_posts()`
3. `wp-includes/blocks.php:1133` - `render()`
4. `wp-includes/blocks.php:1171` - `render_block()`
5. `wp-includes/class-wp-hook.php:312` - `do_blocks()`
6. `wp-includes/plugin.php:205` - `apply_filters('<!-- wp:latest-posts {"categories":"","postsToShow":3,"displayPostContent":true,"displayPostDate":true,"className":"is-style-default"} /-->')`
7. `wp-includes/widgets/class-wp-widget-block.php:78` - `apply_filters('widget_block_content')`
8. `wp-includes/class-wp-widget.php:407` - `widget()`
9. `wp-includes/widgets.php:837` - `display_callback()`
10. `/themes/pub/twentysixteen/sidebar.php:13` - `dynamic_sidebar()`
11. `wp-includes/template.php:785` - `require_once('/themes/pub/twentysixteen/sidebar.php')`
12. `wp-includes/template.php:720` - `load_template()`
13. `wp-includes/general-template.php:136` - `locate_template()`
14. `/themes/pub/twentysixteen/page.php:41` - `get_sidebar()`
15. `wp-includes/template-loader.php:106` - `include('/themes/pub/twentysixteen/page.php')`
16. `wp-blog-header.php:19` - `require_once('wp-includes/template-loader.php')`
17. `index.php:49` - `require('wp-blog-header.php')`

While it shows twentysixteen there, it's not caused by this specific theme. It seems to happy with other legacy themes as well. It does seem related to block widgets, though.

I found a similar issue from 2020 here: #21359, but it was related to a recent schema change that happened at the time, which shouldn't be the case now. cc'ing @ryelle for insights just in case 👋🏻

Also cc'ing @noisysocks as he was part of the original Slack discussion about this issue 👋🏻

Step-by-step reproduction instructions

I couldn't reproduce it on a new site, but you can force-reproduce it by setting the $attributes['categories'] to '' here: https://github.com/WordPress/gutenberg/blame/trunk/packages/block-library/src/latest-posts/index.php#L60.

Screenshots, screen recording, code snippet

No response

Environment info

• Wordpress 6.3
• Gutenberg 16.3-16.4WordPress

Please confirm that you have searched existing issues in the repo.

Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

Yes