fix: only validate PHP when activating snippets in bulk

[TallblokeUK]

Prompted by Issue saving custom JS snippets due to strict validation/sanitization rules.

The reporter's explanation is not right — we do not validate JavaScript syntax, and there are no regex rules on declarations or DOM calls. I tested every pattern they named and all are fine:

pattern	result
el => { … }	fine
Array.from().filter()	fine
MutationObserver	fine
URLSearchParams	fine

But their experience was real, and there is a genuine bug underneath it.

The bug

activate_snippets() runs every selected snippet through the PHP validator, whatever its type:

foreach ( $snippets as $snippet ) {
    $validator = new Validator( $snippet->code );

The other two callers guard this on 'php' === $snippet->type. This one was missed.

The validator does not check syntax. It looks for redeclarations of functions and classes that already exist in PHP. Run against a script, any function sharing a name with a PHP built-in reads as a redeclaration. All of these are refused:

next, reset, current, key, count, sort, end, compact, extract, header

Those are ordinary names in JavaScript. A carousel with next() and reset() cannot be bulk activated.

And the same snippet activates fine on its own, because the single-activation path is guarded. That inconsistency is what makes it look like arbitrary validation rules from the outside.

It fails silently. Invalid snippets are dropped from the batch rather than reported, so the snippet just stays inactive with nothing said. Worse, one bad snippet makes the whole call return null.

The fix

Validate only PHP, matching the other two callers.

Testing

6 unit tests. Two fail without the fix; the other four are guards proving PHP checking is intact:

test	without fix
JS naming PHP built-ins can be bulk activated	fails
One invalid PHP snippet does not block the batch	fails
PHP redeclaring an existing function is still refused	passes (guard)
Valid PHP is still bulk activated	passes (guard)
Single activation already worked	passes (guard)
Stylesheets can be bulk activated	passes (guard)

Also verified through the admin UI on WP 7.1: created a JavaScript snippet containing next() and reset(), selected it, chose Activate, pressed Apply.

	result
Before	stays inactive, nothing reported
After	activates

Full suite 163 tests, phpcs clean.

Related

The silent failure is the same problem as #488 — a batch can fail entirely and say nothing. That draft would surface this class of thing; this fixes the cause of one instance of it.

Worth asking the reporter whether their scripts declare functions with any of the names above, to confirm this is what they hit rather than something still hiding.

[TallblokeUK]

Worth adding, because it makes this bigger than the fixed list of PHP built-ins I gave above.

check_duplicate_identifier() builds its list from get_defined_functions():

array_merge( $defined_functions['internal'], $defined_functions['user'] )

So it is not just PHP internals. It is every function declared by WordPress, the active plugins and the theme. On a modest test install that is 5,658 names — 1,623 internal and 4,035 from user code.

Measured against thirty names a script author might plausibly use, twenty collided:

next, reset, current, key, count, sort, end, compact, extract, header,
range, min, max, round, floor, abs, join, trim, shuffle, log

log, min, max, round, floor, abs, join, trim are hard to avoid in JavaScript.

Two consequences:

• The affected set was specific to each site, and grew with every plugin activated. Two installs with identical snippets behaved differently, which is exactly why this reads as arbitrary validation from the outside and is awkward to reproduce on request.
• It was getting worse over time. The more a site grew, the more script names became unusable.

I have added a seventh test that derives its name from the live get_defined_functions() list rather than hard-coding one, so it stays honest whatever is loaded in the test environment. It fails without the fix ("A script declaring next should still activate") and passes with it.