WordPress / WordPress/secure-custom-fields

scf/list-fields ability fails its own output schema for code-registered fields and unknown field types

Open
#453 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Type] Bug
Dominant language
PHP
Stars
131
Forks
64
Avg merge
10m
Merged PRs (30d)
1

Description

Description

The scf/list-fields ability validates its output against an output_schema that is an array of oneOf over ~39 per-field-type variants (each pinning type to a single-value enum, with additionalProperties: false and internal properties requiring ID >= 1). Because array validation is all-or-nothing, a single non-conforming field invalidates the entire listing, returning ability_invalid_output instead of results.

Two independent triggers:

  1. Code-registered fields always fail. Fields registered via acf_add_local_field_group() legitimately have ID => 0, violating the ID minimum: 1 constraint in schemas/internal-properties.schema.json. Any site that registers fields in code — a very common pattern — gets a broken scf/list-fields.
  2. Unknown field types fail. A field stored with a type that has no schema variant (third-party field type, or a type whose plugin was deactivated) matches no oneOf branch and poisons the whole response.

Additionally, the comment at includes/class-scf-schema-builder.php:30 claims a "Fallback variant allows unknown types until all 35 field types have schemas" — but the generated schemas/field.schema.json contains no fallback variant. The stale comment points at the missing piece.

Affected code

  • includes/abilities/class-scf-field-abilities.php:277-281 (list output schema)
  • schemas/internal-properties.schema.json (ID definition, minimum: 1)
  • includes/class-scf-schema-builder.php:30 (stale fallback comment)

Reproduction

Covered by repro tests in #450: tests/php/includes/abilities/test-scf-list-fields-schema-robustness.php

  • test_local_text_field_fails_output_schema_due_to_id_zero
  • test_single_drifted_field_invalidates_entire_list_output

Also observed live as an order-dependent E2E failure before suite isolation was added (a stray malformed field bricked the listing for the whole run).

Suggested fix directions

  • Add the permissive fallback oneOf variant the schema-builder comment promises, and/or
  • Relax ID to minimum: 0 (or document local fields' ID semantics), and/or
  • Sanitize/skip invalid items in list_callback so one bad field degrades to omission instead of total failure.

Found during the 2026-06 test campaign (see PR #450).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with tests/php/includes/abilities/test-scf-list-fields-schema-robustness.php and the affected list output schema in includes/abilities/class-scf-field-abilities.php. Then inspect schemas/internal-properties.schema.json and includes/class-scf-schema-builder.php; done means code-registered fields and unknown field types no longer invalidate the entire scf/list-fields response, with the repro tests passing.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.