Array to string conversion warning in AltSessions.php line 227

[austinginder]

Plugin version: 6.75
PHP version: 8.1 / 8.3
WordPress version: 6.x

Description

AltSessions.php:227 triggers an "Array to string conversion" warning when $value is an array and the type annotation is string.

The warning fires on every POST /wp-json/cleantalk-antispam/v1/alt_sessions request where the cookie value happens to be an array.

Steps to reproduce

1. Visit a page with CleanTalk active
2. A POST /wp-json/cleantalk-antispam/v1/alt_sessions request fires
3. If any cookie value is an array, the (string)$value cast on line 227 triggers the warning

Location

lib/Cleantalk/ApbctWP/Variables/AltSessions.php, line 227:

case 'string':
    $cookies_array[$name] = (string)$value;
    break;

Suggested fix

Check if $value is an array before casting:

case 'string':
    $cookies_array[$name] = is_array($value) ? wp_json_encode($value) : (string)$value;
    break;

[AntonV1211]

Hello @austinginder !
Your suggested edit is logical, but can you show an example of such cookies, most likely it's either ct_checkjs or ct_sfw_pass_key?

The fact is that this can only happen with two cookies: ct_checkjs and ct_sfw_pass_key. ct_checkjs should initially transmit an integer, and ct_sfw_pass_key is either an md5 hash or 0. That is, in neither case is an array implied.

[austinginder]

Thanks for the quick response! I traced the path through the JS and PHP to find the source.

The root cause is in apbctLocalStorage.get() in apbct-public-bundle.js (around line 2405):

get: function(key, property) {
    // ...
    const json = JSON.parse(storageValue);
    if ( json.hasOwnProperty(property) ) {
        try {
            // if property can be parsed as JSON - do it
            return JSON.parse( json[property] );
        } catch (e) {
            return json[property].toString();
        }
    }
}

When retrieving ct_checkjs from localStorage, it parses the wrapper JSON, then calls JSON.parse(json.value) on the inner value. If the ct_checkjs value happens to be valid JSON (e.g. starts with [ or {), JSON.parse returns an array/object instead of a string. That parsed value then flows through ctSetAlternativeCookie → apbct_public_sendREST → the alt_sessions REST endpoint, arriving in PHP as an array instead of a string.

The path is:

1. apbctLocalStorage.get('ct_checkjs') returns an array (due to double JSON parse)
2. initCookies.push(['ct_checkjs', apbctLocalStorage.get('ct_checkjs')]) (line 2091)
3. ctSetAlternativeCookie(initCookies) sends it via REST
4. PHP setFromRemote() receives ct_checkjs as an array
5. The case 'string': (string)$value cast triggers the warning

We saw this across 53 unique visitor IPs on two different sites, so it's not a single bot — it appears to be a real-world edge case in how certain ct_checkjs values round-trip through localStorage.

The PHP-side guard in my PR is still a good safety net, but the deeper fix would be to ensure apbctLocalStorage.get() doesn't double-parse scalar values into arrays.