Commit 7bd7c7f8273 for woocommerce

commit 7bd7c7f827334c9ee698da2ed60b8153130f805d
Author: Soroush Ahmadi <mrsoroushahmadi@gmail.com>
Date:   Wed Sep 16 20:15:51 2026 +0330

    Treat array-valued key on Blocks order confirmation as invalid instead of fataling (#68584)

    An array key passes the empty() check, survives wp_unslash()/wc_clean()
    as an array, and reaches hash_equals() in WC_Order::key_is_valid(),
    throwing an uncaught TypeError on PHP 8. Require a string key (same
    guard as #68307) so bad input falls through to invalid-order handling.

    Fixes #68583

    Co-authored-by: soroush5 <soroush5@users.noreply.github.com>

diff --git a/plugins/woocommerce/changelog/68583-blocks-order-confirmation-array-key b/plugins/woocommerce/changelog/68583-blocks-order-confirmation-array-key
new file mode 100644
index 00000000000..3c90136bb13
--- /dev/null
+++ b/plugins/woocommerce/changelog/68583-blocks-order-confirmation-array-key
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Treat an array-valued key on the Blocks order confirmation page as absent so it falls through to the invalid-order handling instead of fataling in hash_equals().
diff --git a/plugins/woocommerce/src/Blocks/BlockTypes/OrderConfirmation/AbstractOrderConfirmationBlock.php b/plugins/woocommerce/src/Blocks/BlockTypes/OrderConfirmation/AbstractOrderConfirmationBlock.php
index 2afc436432a..3c4c3a98ba9 100644
--- a/plugins/woocommerce/src/Blocks/BlockTypes/OrderConfirmation/AbstractOrderConfirmationBlock.php
+++ b/plugins/woocommerce/src/Blocks/BlockTypes/OrderConfirmation/AbstractOrderConfirmationBlock.php
@@ -229,7 +229,7 @@ abstract class AbstractOrderConfirmationBlock extends AbstractBlock {
 	 */
 	protected function has_valid_order_key( $order ) {
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
-		return ! empty( $_GET['key'] ) && $order->key_is_valid( wc_clean( wp_unslash( $_GET['key'] ) ) );
+		return isset( $_GET['key'] ) && is_string( $_GET['key'] ) && $order->key_is_valid( wc_clean( wp_unslash( $_GET['key'] ) ) );
 	}

 	/**
diff --git a/plugins/woocommerce/tests/php/src/Blocks/BlockTypes/OrderConfirmation/AbstractOrderConfirmationBlockTest.php b/plugins/woocommerce/tests/php/src/Blocks/BlockTypes/OrderConfirmation/AbstractOrderConfirmationBlockTest.php
index 4f9b282784d..3912f6917a5 100644
--- a/plugins/woocommerce/tests/php/src/Blocks/BlockTypes/OrderConfirmation/AbstractOrderConfirmationBlockTest.php
+++ b/plugins/woocommerce/tests/php/src/Blocks/BlockTypes/OrderConfirmation/AbstractOrderConfirmationBlockTest.php
@@ -36,12 +36,36 @@ final class AbstractOrderConfirmationBlockTest extends WC_Unit_Test_Case {
 				return $this->email_verification_permitted( $order );
 			}
 			// phpcs:ignore Squiz.Commenting.FunctionComment.Missing
+			public function has_valid_order_key_proxy( WC_Order $order ): bool {
+				return $this->has_valid_order_key( $order );
+			}
+			// phpcs:ignore Squiz.Commenting.FunctionComment.Missing
 			protected function render_content( $order, $permission = false, $attributes = array(), $content = '' ) {
 				return '';
 			}
 		};
 	}

+	/**
+	 * @testdox An array order key is treated as invalid instead of reaching hash_equals().
+	 */
+	public function test_array_order_key_is_treated_as_invalid(): void {
+		$order       = \WC_Helper_Order::create_order();
+		$_GET['key'] = array( $order->get_order_key() );
+
+		$this->assertFalse( $this->sut->has_valid_order_key_proxy( $order ), 'An array key must be rejected without reaching hash_equals().' );
+	}
+
+	/**
+	 * @testdox A string order key still validates.
+	 */
+	public function test_string_order_key_still_validates(): void {
+		$order       = \WC_Helper_Order::create_order();
+		$_GET['key'] = $order->get_order_key();
+
+		$this->assertTrue( $this->sut->has_valid_order_key_proxy( $order ), 'A valid string key must keep validating.' );
+	}
+
 	/**
 	 * @testdox Order details require the correct key and the appropriate owner, session, grace-period, or verified-email context.
 	 * @dataProvider view_permission_cases