Header logo rendering crashes when the Logo sanitizer receives an array

[pirate-bot]

Summary

Header logo processing can terminate a frontend request when the Logo sanitizer receives an array-valued logo input. The theme is expected to render the configured logo or use a safe default when stored logo data has an unexpected shape. Instead, the reported request ends with json_decode(): Argument #1 ($json) must be of type string, array given. Affected pages fail during header rendering.

Customer context

• Product / area: Neve, Header/Footer Grid Logo component
• Version: 4.2.11
• Environment: WordPress and PHP versions were not provided; the error signature requires a PHP runtime enforcing the reported argument type
• Integration / third party: None identified
• Reported error / symptom: TypeError: json_decode(): Argument #1 ($json) must be of type string, array given
• Impact: 18 captured occurrences on one site during frontend header rendering; the theme had been active for 8 hours

Reproduction notes

1. On Neve 4.2.11, arrange for the primary logo value used by the active Header/Footer Grid Logo component to resolve to an array. The exact customer-side writer is unknown.
2. Request a frontend page that renders the header.
3. Reported result: header script generation terminates in Logo::sanitize_logo_json() with the json_decode() array-argument TypeError.

The production trace confirms the failure path; a separate local WordPress runtime reproduction was not run.

Diagnosis

Conclusion

The production crash trace directly reaches Logo::sanitize_logo_json() with an array, and the 4.2.11 implementation passes that value to json_decode() without a type check. This confirms a product defect on the inspected Logo path. No matching GitHub issue or pull request was found. The same unguarded contract predates 4.2.11, so available history does not establish a regression.

Where this likely occurs

• Header rendering: header-footer-grid/Core/Components/Logo.php — Logo::filter_logo_variants() lines 213–223 obtains the primary logo value and evaluates Logo::sanitize_logo_json() as the fallback while building frontend variants; this matches the reported toggle_script() call chain.
• Input handling: header-footer-grid/Core/Components/Logo.php — Logo::sanitize_logo_json() lines 303–323 calls json_decode() at line 311 before validating the decoded value, despite the reported runtime input being an array.
• Template path: header-footer-grid/templates/components/component-logo.php — logo component template approx. lines 22–27 also evaluates Logo::sanitize_logo_json() while deriving the active logo.
• Customizer registration: header-footer-grid/Core/Settings/Manager.php — Manager::load() lines 131–141 registers component-provided sanitizer callbacks, exposing the same input contract during Customizer setting processing.
• Commit 5894c6ada2 introduced the unguarded Logo JSON decode in 2021. The relevant files did not change between v4.2.10 and v4.2.11; no last-known-good release boundary was identified.

Engineering notes

The standard React Logo palette serializes its object before saving, so the normal current UI nominally provides JSON text. The frontend path can nevertheless receive array-valued persisted, imported, filtered, or compatibility data; the telemetry proves an array reached this method but does not identify its producer. The inspected defect is in Neve core's Header/Footer Grid package rather than a Pro add-on.

Test coverage status

tests/js/logo-toggle-script.test.mjs lines 1–53 tests JavaScript scoping, observer behavior, and light/dark logo swapping, but does not exercise Logo::sanitize_logo_json() or array-valued PHP input. No relevant PHP, integration, or e2e coverage was found during inspection.

What to verify or explore next

• Reproduce on v4.2.11 with the primary logo value resolving to an array, then request a frontend page with the Logo component active.
• May be worth checking Customizer saves, starter-site imports, migrations, and theme_mod_* filters for supported workflows that can produce the observed array value.
• Exercise the Logo sanitizer with valid JSON, scalar attachment IDs, empty values, malformed JSON, and arrays across supported PHP versions.

Unknowns / follow-up

• The WordPress and PHP versions were not captured.
• The source and exact contents of the array-valued logo input are unknown.

Confidence

Confidence: 99/100

Neve 4.2.11 telemetry and source inspection confirm a previously untracked frontend Logo sanitizer crash. The visual complaint is not specific enough to verify, while the single-post null-ordering crash is already explicitly covered by open issue #4593 and PR #4597, including a null-value test case.

---

Source: automated uninstall feedback — neve, 2026-08-30
Generated by bug-report-triage (ID: bug-report-triage_6a950a8cd48bc4.25766917)