From: Alexander Ebert <ebert@woltlab.com>
Date: Thu, 9 Jan 2025 11:02:55 +0000 (+0100)
Subject: Add a safe-guard against misbehaving metacodes
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=7e305277c70cb69c4d566d99c44eef497f6614a1;p=GitHub%2FWoltLab%2FWCF.git

Add a safe-guard against misbehaving metacodes
---

diff --git a/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php b/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
index c082a869db..f93aee3416 100644
--- a/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
+++ b/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
@@ -121,6 +121,16 @@ abstract class AbstractHtmlNodeProcessor implements IHtmlNodeProcessor
                     $obj = $data['object'];
                     $string = $obj->replaceTag($data['data']);
 
+                    if (!\is_string($string) && !\is_numeric($string)) {
+                        throw new \RuntimeException(
+                            \sprintf(
+                                "%s::replaceTag() returned %s but a string or number was expected.",
+                                \get_class($obj),
+                                \gettype($string),
+                            ),
+                        );
+                    }
+
                     if (!isset($data['data']['skipInnerContent']) || $data['data']['skipInnerContent'] !== true) {
                         if (\str_contains($string, '<!-- META_CODE_INNER_CONTENT -->')) {
                             return \str_replace('<!-- META_CODE_INNER_CONTENT -->', $matches['content'], $string);