Gutenberg feed endpoint crashes when url is a string #1316

Summary

The Gutenberg feed REST endpoint can terminate with a TypeError when its url parameter is submitted as a string.

Expected behavior: the endpoint accepts or rejects a single feed URL without an uncaught exception.

Actual behavior: processing a scalar url value triggers count(): Argument #1 ($value) must be of type Countable|array, string given.

Impact: requests reaching this input shape cannot load feed data and produce repeated production crashes.

Customer context

• Product / area: Feedzy RSS Feeds Gutenberg feed REST endpoint
• Version: 5.2.8
• Environment: WordPress 7.0.4, PHP 8.4.23
• Integration / third party: Not applicable
• Reported error / symptom: TypeError: count(): Argument #1 ($value) must be of type Countable|array, string given
• Impact: 27 telemetry occurrences across one site from 2026-08-17 through 2026-08-20; request context was REST.

Reproduction notes

1. Use an authenticated request that can edit the supplied post.
2. Send POST /wp-json/feedzy/v1/feed with url as a scalar feed URL rather than a bracketed array parameter, plus a valid postId.
3. Observed production result on Feedzy 5.2.8 with PHP 8.4: uncaught TypeError at the sanitizer's count() call.

The normal block editor submits url[]; the exact scalar-producing client is not available in telemetry.

Diagnosis

Conclusion

Behavior inventory item 1: a scalar url value reaching POST /feedzy/v1/feed crashes in the Feedzy sanitizer. The production stack trace identifies Feedzy_Rss_Feeds_Gutenberg_Block::feedzy_sanitize_feeds() at line 401, and the released v5.2.8 source unconditionally invokes count( $input ) before indexing and iterating $input. The REST route declares a sanitizer but no array type/schema for url, leaving this callback reachable with the reported string input.

Where this likely occurs

• includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php — Feedzy_Rss_Feeds_Gutenberg_Block::__construct() lines 41-46 registers the REST-route callback on rest_api_init.
• includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php — Feedzy_Rss_Feeds_Gutenberg_Block::feedzy_register_rest_route() lines 280-300 registers POST /feedzy/v1/feed and assigns url to feedzy_sanitize_feeds() at lines 291-294 without a type/schema restriction.
• includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php — Feedzy_Rss_Feeds_Gutenberg_Block::feedzy_sanitize_feeds() lines 400-412 assumes $input is an array; line 401 is the crash location and lines 402 and 406 also use array operations.
• Release tag v5.2.8 resolves to 063c6a6b5f84c4de9b82aac16877640a9b146a35; its sanitizer matches the inspected checkout. git diff v5.2.8..HEAD for this file is empty.
• git blame attributes the array-only method structure to faf4fc29 (Added Gutenberg Block for Feedzy, 2018-04-30); line 401 changed from sizeof() to count() in 58f4f039 (2021-04-13), with no type handling added.

Engineering notes

The editor's nominal path serializes URLs as bracketed array parameters after splitting the input: js/FeedzyBlock/Editor.js — editor request construction lines 206-218. That path does not protect the REST endpoint when a scalar parameter reaches it through another request shape. Feedzy Pro was checked: no Pro override, subclass, or alternate registration of this sanitizer or route was found. This diagnosis concerns the inspected REST parameter path; the original caller producing the scalar value is not identified by telemetry.

Test coverage status

No relevant PHPUnit coverage was found for feedzy_sanitize_feeds(), Feedzy_Rss_Feeds_Gutenberg_Block, or /feedzy/v1/feed. tests/e2e/specs/classic-block.spec.js lines 7-67 covers invalid and mixed URL input through the editor's array-shaped request flow, not a direct scalar url REST request.

What to verify or explore next

• Reproduce an authenticated POST /feedzy/v1/feed request with a scalar url and a valid editable postId on PHP 8.4.
• Check whether other internal clients, legacy block versions, or integrations issue the scalar request shape.
• Run the existing classic-block E2E suite alongside a targeted REST regression check.

Unknowns / follow-up

• Telemetry does not include the request payload, so the component that submitted the scalar value is unknown.
• WordPress REST argument coercion behavior was not inspected from WordPress core source; the production stack trace and the reported string argument establish that the sanitizer received a scalar in this incident.

Confidence

Confidence: 99/100

Behavior inventory: 1. A scalar url REST parameter crashes Feedzy's Gutenberg feed endpoint. Production telemetry supplies a matching stack trace, and the 5.2.8 source directly calls count() on the untyped REST value.

Crash telemetry

Source: automated crash report — feedzy-rss-feeds, fingerprint 0c6c0b9806bbcbe924ce32fc2ae3f40e
Generated by bug-report-triage (ID: bug-report-triage_6a87e98dc4acb7.14680274)