PHP Fatal Error

Hello again!

I’m getting an intermittent fatal error logged in my PHP error log:

PHP Fatal error: Uncaught TypeError: array_key_exists(): Argument #2 ($array) must be of type array, false given in .../wp-content/advanced-cache.php:332

Stack trace:
#0 advanced-cache.php(301): swcfpc_fallback_cache_remove_url_parameters()
#1 advanced-cache.php(306): swcfpc_normalize_url()
#2 advanced-cache.php(80): swcfpc_fallback_cache_get_current_page_cache_key()
#3 wp-settings.php(100): include('...')
#4 wp-config.php(94): require_once('...')
#5 wp-load.php(55): require_once('...')
#6 wp-blog-header.php(13): require_once('...')
#7 index.php(17): require('...')

I looked at the relevant code in advanced-cache.php:

function swcfpc_fallback_cache_remove_url_parameters( $url ) {
	$url_parsed       = parse_url( $url );
	$url_query_params = [];

	if ( array_key_exists( 'query', $url_parsed ) ) {
		...

parse_url() returns false when given a malformed URL, instead of an array. When that happens, $url_parsed is false, and the array_key_exists() call on line 332 throws a fatal TypeError instead of failing gracefully.

This has happened on two separate dates so far – once on June 6th (4 occurrences within the same second), and again today, June 17th (9 occurrences within about 90 seconds). I haven’t confirmed whether this results in a visible error/downtime for visitors on those specific requests, or whether something else recovers the page; I only have the error log entries.

I was able to correlate the timestamps with my Apache access log and found the likely trigger. Around the same second as the fatal errors, a scanner (using curl, port-probing for exposed services) sent requests like:

GET /:27017
GET /:27018
GET /:6379
GET /:5432
GET /:8983

These are malformed paths – a bare colon followed by a port number, with no hostname before it. This kind of string would likely break parse_url() in an unexpected way (since the part before the colon can be interpreted as a URL scheme), which would explain why $url_parsed comes back as false instead of an array.

Could this be patched in an upcoming release?

Thanks for your help.