From 7e305277c70cb69c4d566d99c44eef497f6614a1 Mon Sep 17 00:00:00 2001
From: Alexander Ebert <ebert@woltlab.com>
Date: Thu, 9 Jan 2025 12:02:55 +0100
Subject: [PATCH] Add a safe-guard against misbehaving metacodes

---
 .../html/node/AbstractHtmlNodeProcessor.class.php      | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php b/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
index c082a869db..f93aee3416 100644
--- a/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
+++ b/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
@@ -121,6 +121,16 @@ abstract class AbstractHtmlNodeProcessor implements IHtmlNodeProcessor
                     $obj = $data['object'];
                     $string = $obj->replaceTag($data['data']);
 
+                    if (!\is_string($string) && !\is_numeric($string)) {
+                        throw new \RuntimeException(
+                            \sprintf(
+                                "%s::replaceTag() returned %s but a string or number was expected.",
+                                \get_class($obj),
+                                \gettype($string),
+                            ),
+                        );
+                    }
+
                     if (!isset($data['data']['skipInnerContent']) || $data['data']['skipInnerContent'] !== true) {
                         if (\str_contains($string, '<!-- META_CODE_INNER_CONTENT -->')) {
                             return \str_replace('<!-- META_CODE_INNER_CONTENT -->', $matches['content'], $string);
-- 
2.20.1