From 1944ed1b96747a60ab2d5785c508e7c0b3b85ea0 Mon Sep 17 00:00:00 2001
From: Christoph Daum <christoph.daum@coding-pioneers.com>
Date: Mon, 20 Jul 2026 13:09:40 +0200
Subject: [PATCH 01/27] fix(rest): cast string filesize meta to int

Attachment metadata is untyped, so `filesize` can be stored as a
string (for example, plugins that populate it from a remote storage
API response such as the Google Drive `fileSize` field, which the
API returns as a string). Returning it verbatim violated the `?int`
return type of
`WP_REST_Attachments_Controller::get_attachment_filesize()` and
caused a fatal TypeError for non-numeric values.

Only return the stored value when numeric, casting to int; otherwise
fall through to recompute the size from the file via wp_filesize().

Fixes https://core.trac.wordpress.org/ticket/65670

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../class-wp-rest-attachments-controller.php  | 10 +++-
 .../rest-api/rest-attachments-controller.php  | 54 +++++++++++++++++++
 2 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index a3f68154c18cd..600add97f6e46 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -2363,8 +2363,14 @@ protected function get_attachment_filename( int $attachment_id ): ?string {
 	protected function get_attachment_filesize( int $attachment_id ): ?int {
 		$meta = wp_get_attachment_metadata( $attachment_id );
 
-		if ( isset( $meta['filesize'] ) ) {
-			return $meta['filesize'];
+		/*
+		 * Attachment metadata is untyped, so the stored file size may be a
+		 * string (for example, plugins that populate it from a remote storage
+		 * API response). Only trust numeric values, and fall through to
+		 * recompute the size from the file otherwise.
+		 */
+		if ( isset( $meta['filesize'] ) && is_numeric( $meta['filesize'] ) ) {
+			return (int) $meta['filesize'];
 		}
 
 		$original_path = wp_get_original_image_path( $attachment_id );
diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index 55859c085fdd9..fddc33f7d95df 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1005,6 +1005,60 @@ public function test_get_item() {
 		$this->assertSame( 'image/jpeg', $data['mime_type'] );
 	}
 
+	/**
+	 * Ensures a numeric-string `filesize` in attachment metadata is normalized
+	 * to an integer in the response.
+	 *
+	 * Attachment metadata is untyped, so plugins that populate `filesize` from
+	 * a remote storage API may store it as a string.
+	 *
+	 * @ticket 65670
+	 */
+	public function test_get_item_normalizes_numeric_string_filesize_meta() {
+		$attachment_id = self::factory()->attachment->create_object(
+			self::$test_file,
+			0,
+			array(
+				'post_mime_type' => 'image/jpeg',
+			)
+		);
+
+		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => '123456' ) );
+
+		$request  = new WP_REST_Request( 'GET', '/wp/v2/media/' . $attachment_id );
+		$response = rest_get_server()->dispatch( $request );
+		$data     = $response->get_data();
+
+		$this->assertSame( 200, $response->get_status() );
+		$this->assertSame( 123456, $data['filesize'] );
+	}
+
+	/**
+	 * Ensures a non-numeric `filesize` in attachment metadata does not cause a
+	 * fatal TypeError, falling back to the actual file size.
+	 *
+	 * @ticket 65670
+	 */
+	public function test_get_item_recovers_from_non_numeric_filesize_meta() {
+		$attachment_id = self::factory()->attachment->create_object(
+			self::$test_file,
+			0,
+			array(
+				'post_mime_type' => 'image/jpeg',
+			)
+		);
+
+		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => 'corrupt' ) );
+
+		$request  = new WP_REST_Request( 'GET', '/wp/v2/media/' . $attachment_id );
+		$response = rest_get_server()->dispatch( $request );
+		$data     = $response->get_data();
+
+		$this->assertSame( 200, $response->get_status() );
+		$this->assertIsInt( $data['filesize'] );
+		$this->assertSame( filesize( self::$test_file ), $data['filesize'] );
+	}
+
 	/**
 	 * @requires function imagejpeg
 	 */

From ba9bf7302b6034ee283abe4d63b678e8b121efd4 Mon Sep 17 00:00:00 2001
From: Christoph Daum <christoph.daum@coding-pioneers.com>
Date: Mon, 20 Jul 2026 13:41:52 +0200
Subject: [PATCH 02/27] docs(rest): trim filesize guard comment per review

Shorten the inline comment in get_attachment_filesize() to the
essential rationale, per PR review feedback.

See https://core.trac.wordpress.org/ticket/65670

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../endpoints/class-wp-rest-attachments-controller.php        | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index 600add97f6e46..e2acc3b733fca 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -2364,9 +2364,7 @@ protected function get_attachment_filesize( int $attachment_id ): ?int {
 		$meta = wp_get_attachment_metadata( $attachment_id );
 
 		/*
-		 * Attachment metadata is untyped, so the stored file size may be a
-		 * string (for example, plugins that populate it from a remote storage
-		 * API response). Only trust numeric values, and fall through to
+		 * Only trust numeric values, and fall through to
 		 * recompute the size from the file otherwise.
 		 */
 		if ( isset( $meta['filesize'] ) && is_numeric( $meta['filesize'] ) ) {

From dfb925e6e92d720d3afc080c9499890a9f079809 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Mon, 20 Jul 2026 19:58:15 -0700
Subject: [PATCH 03/27] Eliminate legacy args for create_object() and add
 assertions to fix PHPStan issues in tests

---
 .../tests/rest-api/rest-attachments-controller.php    | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index fddc33f7d95df..418f432cd17bc 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1016,12 +1016,12 @@ public function test_get_item() {
 	 */
 	public function test_get_item_normalizes_numeric_string_filesize_meta() {
 		$attachment_id = self::factory()->attachment->create_object(
-			self::$test_file,
-			0,
 			array(
+				'file'           => self::$test_file,
 				'post_mime_type' => 'image/jpeg',
 			)
 		);
+		$this->assertIsInt( $attachment_id );
 
 		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => '123456' ) );
 
@@ -1029,6 +1029,7 @@ public function test_get_item_normalizes_numeric_string_filesize_meta() {
 		$response = rest_get_server()->dispatch( $request );
 		$data     = $response->get_data();
 
+		$this->assertIsArray( $data );
 		$this->assertSame( 200, $response->get_status() );
 		$this->assertSame( 123456, $data['filesize'] );
 	}
@@ -1041,12 +1042,12 @@ public function test_get_item_normalizes_numeric_string_filesize_meta() {
 	 */
 	public function test_get_item_recovers_from_non_numeric_filesize_meta() {
 		$attachment_id = self::factory()->attachment->create_object(
-			self::$test_file,
-			0,
 			array(
+				'file'           => self::$test_file,
 				'post_mime_type' => 'image/jpeg',
 			)
 		);
+		$this->assertIsInt( $attachment_id );
 
 		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => 'corrupt' ) );
 
@@ -1054,6 +1055,7 @@ public function test_get_item_recovers_from_non_numeric_filesize_meta() {
 		$response = rest_get_server()->dispatch( $request );
 		$data     = $response->get_data();
 
+		$this->assertIsArray( $data );
 		$this->assertSame( 200, $response->get_status() );
 		$this->assertIsInt( $data['filesize'] );
 		$this->assertSame( filesize( self::$test_file ), $data['filesize'] );
@@ -1072,6 +1074,7 @@ public function test_get_item_sizes() {
 			),
 			self::$test_file
 		);
+		$this->assertIsInt( $attachment_id );
 
 		add_image_size( 'rest-api-test', 119, 119, true );
 		wp_update_attachment_metadata( $attachment_id, wp_generate_attachment_metadata( $attachment_id, self::$test_file ) );

From e6944644b9469a89d312e867279b7493216f29ab Mon Sep 17 00:00:00 2001
From: Christoph Daum <christoph.daum@coding-pioneers.com>
Date: Tue, 21 Jul 2026 08:32:37 +0200
Subject: [PATCH 04/27] fix(rest): require positive integer filesize meta

Refine the filesize metadata guard per PR review: accept only a
positive integer (an int or a digit-only string), rather than any
numeric value. This avoids silently truncating float strings such
as '123.4' via the int cast, and rejects zero and negative values,
falling through to recompute the size from the file in those cases.

Also document the method's positive-integer return with a
@phpstan-return non-negative-int|null annotation.

See https://core.trac.wordpress.org/ticket/65670

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../class-wp-rest-attachments-controller.php  | 12 ++++++--
 .../rest-api/rest-attachments-controller.php  | 30 ++++++++++++++++---
 2 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index e2acc3b733fca..181a5eca74e26 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -2359,15 +2359,21 @@ protected function get_attachment_filename( int $attachment_id ): ?string {
 	 *
 	 * @param int $attachment_id Attachment ID.
 	 * @return int|null Attachment file size in bytes, or null if not available.
+	 *
+	 * @phpstan-return non-negative-int|null
 	 */
 	protected function get_attachment_filesize( int $attachment_id ): ?int {
 		$meta = wp_get_attachment_metadata( $attachment_id );
 
 		/*
-		 * Only trust numeric values, and fall through to
-		 * recompute the size from the file otherwise.
+		 * Attachment metadata is untyped, so only trust a positive integer
+		 * value (including a digit-only string, as stored by some plugins).
+		 * Fall through to recompute the size from the file otherwise.
 		 */
-		if ( isset( $meta['filesize'] ) && is_numeric( $meta['filesize'] ) ) {
+		if ( isset( $meta['filesize'] )
+			&& ( is_int( $meta['filesize'] ) || ctype_digit( $meta['filesize'] ) )
+			&& $meta['filesize'] > 0
+		) {
 			return (int) $meta['filesize'];
 		}
 
diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index 418f432cd17bc..c19c1eeab4701 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1035,12 +1035,17 @@ public function test_get_item_normalizes_numeric_string_filesize_meta() {
 	}
 
 	/**
-	 * Ensures a non-numeric `filesize` in attachment metadata does not cause a
-	 * fatal TypeError, falling back to the actual file size.
+	 * Ensures a `filesize` metadata value that is not a positive integer does
+	 * not cause a fatal TypeError or a silently truncated size, falling back to
+	 * the actual file size instead.
 	 *
 	 * @ticket 65670
+	 *
+	 * @dataProvider data_invalid_filesize_meta
+	 *
+	 * @param mixed $filesize Invalid `filesize` metadata value.
 	 */
-	public function test_get_item_recovers_from_non_numeric_filesize_meta() {
+	public function test_get_item_recovers_from_invalid_filesize_meta( $filesize ) {
 		$attachment_id = self::factory()->attachment->create_object(
 			array(
 				'file'           => self::$test_file,
@@ -1049,7 +1054,7 @@ public function test_get_item_recovers_from_non_numeric_filesize_meta() {
 		);
 		$this->assertIsInt( $attachment_id );
 
-		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => 'corrupt' ) );
+		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => $filesize ) );
 
 		$request  = new WP_REST_Request( 'GET', '/wp/v2/media/' . $attachment_id );
 		$response = rest_get_server()->dispatch( $request );
@@ -1061,6 +1066,23 @@ public function test_get_item_recovers_from_non_numeric_filesize_meta() {
 		$this->assertSame( filesize( self::$test_file ), $data['filesize'] );
 	}
 
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public function data_invalid_filesize_meta() {
+		return array(
+			'non-numeric string'      => array( 'corrupt' ),
+			'float string'            => array( '123.4' ),
+			'scientific notation'     => array( '1e3' ),
+			'zero'                    => array( 0 ),
+			'zero string'             => array( '0' ),
+			'negative integer'        => array( -5 ),
+			'negative integer string' => array( '-5' ),
+		);
+	}
+
 	/**
 	 * @requires function imagejpeg
 	 */

From 91c0463d7a380c4d35afed5dede5975bd306325e Mon Sep 17 00:00:00 2001
From: Christoph Daum <christoph.daum@coding-pioneers.com>
Date: Tue, 21 Jul 2026 08:39:20 +0200
Subject: [PATCH 05/27] fix(rest): guard ctype_digit against non-string meta

Attachment metadata is untyped, so `filesize` may be a float, bool
or other non-string scalar. Passing such a value to ctype_digit()
is fragile (deprecated in PHP 8.1+), so guard the call with
is_string(); non-string scalars now fall through to recompute the
size from the file.

Extend the invalid-value data provider with float and boolean cases.

See https://core.trac.wordpress.org/ticket/65670

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../rest-api/endpoints/class-wp-rest-attachments-controller.php | 2 +-
 tests/phpunit/tests/rest-api/rest-attachments-controller.php    | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index 181a5eca74e26..fb6bf18c17ea9 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -2371,7 +2371,7 @@ protected function get_attachment_filesize( int $attachment_id ): ?int {
 		 * Fall through to recompute the size from the file otherwise.
 		 */
 		if ( isset( $meta['filesize'] )
-			&& ( is_int( $meta['filesize'] ) || ctype_digit( $meta['filesize'] ) )
+			&& ( is_int( $meta['filesize'] ) || ( is_string( $meta['filesize'] ) && ctype_digit( $meta['filesize'] ) ) )
 			&& $meta['filesize'] > 0
 		) {
 			return (int) $meta['filesize'];
diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index c19c1eeab4701..d928572d38e0a 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1076,6 +1076,8 @@ public function data_invalid_filesize_meta() {
 			'non-numeric string'      => array( 'corrupt' ),
 			'float string'            => array( '123.4' ),
 			'scientific notation'     => array( '1e3' ),
+			'float'                   => array( 123.0 ),
+			'boolean'                 => array( true ),
 			'zero'                    => array( 0 ),
 			'zero string'             => array( '0' ),
 			'negative integer'        => array( -5 ),

From 12a4efad5f0e76b5d92a51cc637137d95805a870 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 00:09:52 -0700
Subject: [PATCH 06/27] Remove change to unrelated test

---
 tests/phpunit/tests/rest-api/rest-attachments-controller.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index d928572d38e0a..182b233aa1a30 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1098,7 +1098,6 @@ public function test_get_item_sizes() {
 			),
 			self::$test_file
 		);
-		$this->assertIsInt( $attachment_id );
 
 		add_image_size( 'rest-api-test', 119, 119, true );
 		wp_update_attachment_metadata( $attachment_id, wp_generate_attachment_metadata( $attachment_id, self::$test_file ) );

From 6d2882ea7b6d3f1d725b47a1dc54ad47c3af719d Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 00:10:27 -0700
Subject: [PATCH 07/27] Add typing to data provider

---
 tests/phpunit/tests/rest-api/rest-attachments-controller.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index 182b233aa1a30..d78207435d83f 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1069,9 +1069,9 @@ public function test_get_item_recovers_from_invalid_filesize_meta( $filesize ) {
 	/**
 	 * Data provider.
 	 *
-	 * @return array[]
+	 * @return array<string, array{ 0: mixed }>
 	 */
-	public function data_invalid_filesize_meta() {
+	public function data_invalid_filesize_meta(): array {
 		return array(
 			'non-numeric string'      => array( 'corrupt' ),
 			'float string'            => array( '123.4' ),

From be4985434668aadec95fe26f0a7a75ed4bf7d4d0 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 00:13:45 -0700
Subject: [PATCH 08/27] Remove extra line break

---
 .../rest-api/endpoints/class-wp-rest-attachments-controller.php  | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index fb6bf18c17ea9..642d4167928b9 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -2359,7 +2359,6 @@ protected function get_attachment_filename( int $attachment_id ): ?string {
 	 *
 	 * @param int $attachment_id Attachment ID.
 	 * @return int|null Attachment file size in bytes, or null if not available.
-	 *
 	 * @phpstan-return non-negative-int|null
 	 */
 	protected function get_attachment_filesize( int $attachment_id ): ?int {

From d27aa4bdbf229aa6c16278d04e4e67e825d6e5f3 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 00:18:18 -0700
Subject: [PATCH 09/27] Ensure wp_filesize() never returns a negative number

---
 src/wp-includes/functions.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index ac4781d1f817b..6e8b95f9c78f8 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -3644,8 +3644,9 @@ function wp_get_ext_types() {
  *
  * @param string $path Path to the file.
  * @return int The size of the file in bytes, or 0 in the event of an error.
+ * @phpstan-return non-negative-int
  */
-function wp_filesize( $path ) {
+function wp_filesize( $path ): int {
 	/**
 	 * Filters the result of wp_filesize() before the file_exists() PHP function is run.
 	 *
@@ -3656,7 +3657,7 @@ function wp_filesize( $path ) {
 	 */
 	$size = apply_filters( 'pre_wp_filesize', null, $path );
 
-	if ( is_int( $size ) ) {
+	if ( is_int( $size ) && $size >= 0 ) {
 		return $size;
 	}
 
@@ -3670,7 +3671,8 @@ function wp_filesize( $path ) {
 	 * @param int    $size The result of PHP filesize on the file.
 	 * @param string $path Path to the file.
 	 */
-	return (int) apply_filters( 'wp_filesize', $size, $path );
+	$size = (int) apply_filters( 'wp_filesize', $size, $path );
+	return max( 0, $size );
 }
 
 /**

From a6810a9aff5c44985b561d6a1db777368bfdb3c1 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 00:22:54 -0700
Subject: [PATCH 10/27] Reformat multi-line conditional

---
 .../endpoints/class-wp-rest-attachments-controller.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index 642d4167928b9..e304de07779a4 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -2369,9 +2369,13 @@ protected function get_attachment_filesize( int $attachment_id ): ?int {
 		 * value (including a digit-only string, as stored by some plugins).
 		 * Fall through to recompute the size from the file otherwise.
 		 */
-		if ( isset( $meta['filesize'] )
-			&& ( is_int( $meta['filesize'] ) || ( is_string( $meta['filesize'] ) && ctype_digit( $meta['filesize'] ) ) )
-			&& $meta['filesize'] > 0
+		if (
+			isset( $meta['filesize'] ) &&
+			(
+				is_int( $meta['filesize'] ) ||
+				( is_string( $meta['filesize'] ) && ctype_digit( $meta['filesize'] ) )
+			) &&
+			$meta['filesize'] > 0
 		) {
 			return (int) $meta['filesize'];
 		}

From b6280e0025f2e9f8328750c141c70d2d37928ade Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 11:04:54 -0700
Subject: [PATCH 11/27] Make it clear a non-negative-int is required for the
 short-circuit to work

---
 src/wp-includes/functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 6e8b95f9c78f8..5c9761b98e71b 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -3652,7 +3652,7 @@ function wp_filesize( $path ): int {
 	 *
 	 * @since 6.0.0
 	 *
-	 * @param null|int $size The unfiltered value. Returning an int from the callback bypasses the filesize call.
+	 * @param null|int $size The unfiltered value. Returning a non-negative int from the callback bypasses the filesize call.
 	 * @param string   $path Path to the file.
 	 */
 	$size = apply_filters( 'pre_wp_filesize', null, $path );

From 97bef9625901d3fbb787930d8f869b7aa69560e9 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 12:43:52 -0700
Subject: [PATCH 12/27] Only cast numeric values to integer; treat others as
 zero

---
 src/wp-includes/functions.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 5c9761b98e71b..b50a37ee1e91f 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -3639,6 +3639,7 @@ function wp_get_ext_types() {
  * Wrapper for PHP filesize with filters and casting the result as an integer.
  *
  * @since 6.0.0
+ * @since 7.1.0 The minimum integer now returnable is zero.
  *
  * @link https://www.php.net/manual/en/function.filesize.php
  *
@@ -3651,6 +3652,7 @@ function wp_filesize( $path ): int {
 	 * Filters the result of wp_filesize() before the file_exists() PHP function is run.
 	 *
 	 * @since 6.0.0
+	 * @since 7.1.0 Negative values are now ignored, being treated the same as null.
 	 *
 	 * @param null|int $size The unfiltered value. Returning a non-negative int from the callback bypasses the filesize call.
 	 * @param string   $path Path to the file.
@@ -3667,11 +3669,17 @@ function wp_filesize( $path ): int {
 	 * Filters the size of the file.
 	 *
 	 * @since 6.0.0
+	 * @since 7.1.0 Negative numbers are discarded in favor of zero.
 	 *
 	 * @param int    $size The result of PHP filesize on the file.
 	 * @param string $path Path to the file.
 	 */
-	$size = (int) apply_filters( 'wp_filesize', $size, $path );
+	$size = apply_filters( 'wp_filesize', $size, $path );
+	if ( is_numeric( $size ) ) {
+		$size = (int) $size;
+	} else {
+		$size = 0;
+	}
 	return max( 0, $size );
 }
 

From 32585a8b4ef1e65bfa48d2dd99e6a0f6f2636370 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 12:44:34 -0700
Subject: [PATCH 13/27] Add tests

---
 tests/phpunit/tests/functions/wpFilesize.php | 77 ++++++++++++++------
 1 file changed, 53 insertions(+), 24 deletions(-)

diff --git a/tests/phpunit/tests/functions/wpFilesize.php b/tests/phpunit/tests/functions/wpFilesize.php
index 4ed6de5676bd2..2d51a45475ee6 100644
--- a/tests/phpunit/tests/functions/wpFilesize.php
+++ b/tests/phpunit/tests/functions/wpFilesize.php
@@ -9,46 +9,75 @@
  */
 class Tests_Functions_wpFilesize extends WP_UnitTestCase {
 
+	const TEST_FILE = DIR_TESTDATA . '/images/test-image-upside-down.jpg';
+
 	/**
 	 * @ticket 49412
 	 */
-	public function test_wp_filesize() {
-		$file = DIR_TESTDATA . '/images/test-image-upside-down.jpg';
-
-		$this->assertSame( filesize( $file ), wp_filesize( $file ) );
+	public function test_wp_filesize(): void {
+		$this->assertSame( filesize( self::TEST_FILE ), wp_filesize( self::TEST_FILE ) );
 	}
 
 	/**
 	 * @ticket 49412
 	 */
-	public function test_wp_filesize_filters() {
-		$file = DIR_TESTDATA . '/images/test-image-upside-down.jpg';
-
-		add_filter(
-			'wp_filesize',
-			static function () {
-				return 999;
-			}
-		);
+	public function test_wp_filesize_filters(): void {
+		add_filter( 'wp_filesize', static fn () => 999 );
 
-		$this->assertSame( 999, wp_filesize( $file ) );
+		$this->assertSame( 999, wp_filesize( self::TEST_FILE ) );
 
-		add_filter(
-			'pre_wp_filesize',
-			static function () {
-				return 111;
-			}
-		);
+		add_filter( 'pre_wp_filesize', static fn () => 111 );
 
-		$this->assertSame( 111, wp_filesize( $file ) );
+		$this->assertSame( 111, wp_filesize( self::TEST_FILE ) );
 	}
 
 	/**
 	 * @ticket 49412
 	 */
-	public function test_wp_filesize_with_nonexistent_file() {
-		$file = 'nonexistent/file.jpg';
+	public function test_wp_filesize_with_nonexistent_file(): void {
+		$this->assertSame( 0, wp_filesize( 'nonexistent/file.jpg' ) );
+	}
+
+	/**
+	 * @ticket 65670
+	 */
+	public function test_wp_filesize_pre_wp_filesize_filter_null(): void {
+		add_filter( 'pre_wp_filesize', '__return_null' );
+
+		$this->assertSame( filesize( self::TEST_FILE ), wp_filesize( self::TEST_FILE ) );
+	}
+
+	/**
+	 * @ticket 65670
+	 */
+	public function test_wp_filesize_pre_wp_filesize_filter_negative(): void {
+		add_filter( 'pre_wp_filesize', static fn() => -1 );
+
+		$this->assertSame( filesize( self::TEST_FILE ), wp_filesize( self::TEST_FILE ) );
+	}
 
-		$this->assertSame( 0, wp_filesize( $file ) );
+	/**
+	 * @ticket 65670
+	 *
+	 * @dataProvider data_provider_test_wp_filesize_filter_invalid_value
+	 *
+	 * @param mixed $value
+	 */
+	public function test_wp_filesize_wp_filesize_filter_invalid_value( $value ): void {
+		add_filter( 'wp_filesize', static fn() => $value );
+		$this->assertSame( 0, wp_filesize( self::TEST_FILE ) );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array<string, array{ 0: mixed }>
+	 */
+	public function data_provider_test_wp_filesize_filter_invalid_value(): array {
+		return array(
+			'negative' => array( -1 ),
+			'null'     => array( null ),
+			'array'    => array( array( 'bad', 'array' ) ),
+		);
 	}
 }

From 554a03688caa44ae991a9e03a98b26249daf8632 Mon Sep 17 00:00:00 2001
From: Weston Ruter <westonruter@gmail.com>
Date: Tue, 21 Jul 2026 12:50:45 -0700
Subject: [PATCH 14/27] Improve formatting of arrow functions

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 tests/phpunit/tests/functions/wpFilesize.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/phpunit/tests/functions/wpFilesize.php b/tests/phpunit/tests/functions/wpFilesize.php
index 2d51a45475ee6..7774f8fe53295 100644
--- a/tests/phpunit/tests/functions/wpFilesize.php
+++ b/tests/phpunit/tests/functions/wpFilesize.php
@@ -51,7 +51,7 @@ public function test_wp_filesize_pre_wp_filesize_filter_null(): void {
 	 * @ticket 65670
 	 */
 	public function test_wp_filesize_pre_wp_filesize_filter_negative(): void {
-		add_filter( 'pre_wp_filesize', static fn() => -1 );
+		add_filter( 'pre_wp_filesize', static fn () => -1 );
 
 		$this->assertSame( filesize( self::TEST_FILE ), wp_filesize( self::TEST_FILE ) );
 	}
@@ -64,7 +64,7 @@ public function test_wp_filesize_pre_wp_filesize_filter_negative(): void {
 	 * @param mixed $value
 	 */
 	public function test_wp_filesize_wp_filesize_filter_invalid_value( $value ): void {
-		add_filter( 'wp_filesize', static fn() => $value );
+		add_filter( 'wp_filesize', static fn () => $value );
 		$this->assertSame( 0, wp_filesize( self::TEST_FILE ) );
 	}
 

From 62be93a5d42af5f6499febb1c3f02ca21080ca7a Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 12:53:56 -0700
Subject: [PATCH 15/27] Update filesize key in metadata alone

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../tests/rest-api/rest-attachments-controller.php     | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index 884585c477adc..e3ba87ca98f9b 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1023,7 +1023,10 @@ public function test_get_item_normalizes_numeric_string_filesize_meta() {
 		);
 		$this->assertIsInt( $attachment_id );
 
-		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => '123456' ) );
+		$meta             = wp_get_attachment_metadata( $attachment_id );
+		$meta             = is_array( $meta ) ? $meta : array();
+		$meta['filesize'] = '123456';
+		$this->assertNotFalse( wp_update_attachment_metadata( $attachment_id, $meta ) );
 
 		$request  = new WP_REST_Request( 'GET', '/wp/v2/media/' . $attachment_id );
 		$response = rest_get_server()->dispatch( $request );
@@ -1054,7 +1057,10 @@ public function test_get_item_recovers_from_invalid_filesize_meta( $filesize ) {
 		);
 		$this->assertIsInt( $attachment_id );
 
-		wp_update_attachment_metadata( $attachment_id, array( 'filesize' => $filesize ) );
+		$meta             = wp_get_attachment_metadata( $attachment_id );
+		$meta             = is_array( $meta ) ? $meta : array();
+		$meta['filesize'] = $filesize;
+		$this->assertNotFalse( wp_update_attachment_metadata( $attachment_id, $meta ) );
 
 		$request  = new WP_REST_Request( 'GET', '/wp/v2/media/' . $attachment_id );
 		$response = rest_get_server()->dispatch( $request );

From 001ee72dc561f5058ee2d4a0bf2f6fb77685068d Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 12:57:02 -0700
Subject: [PATCH 16/27] Use attachment's resolved path

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 tests/phpunit/tests/rest-api/rest-attachments-controller.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index e3ba87ca98f9b..e624316a7f868 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1069,7 +1069,10 @@ public function test_get_item_recovers_from_invalid_filesize_meta( $filesize ) {
 		$this->assertIsArray( $data );
 		$this->assertSame( 200, $response->get_status() );
 		$this->assertIsInt( $data['filesize'] );
-		$this->assertSame( filesize( self::$test_file ), $data['filesize'] );
+		$attached_file = wp_get_original_image_path( $attachment_id );
+		$attached_file = $attached_file ? $attached_file : get_attached_file( $attachment_id );
+		$this->assertIsString( $attached_file );
+		$this->assertSame( filesize( $attached_file ), $data['filesize'] );
 	}
 
 	/**

From c50756deecdfe76f8cadcf82bf8a1700067d4b4d Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:13:53 -0700
Subject: [PATCH 17/27] Relax attachment metadata filesize to include numeric
 values

---
 .../class-wp-rest-attachments-controller.php  | 14 +--------
 .../rest-api/rest-attachments-controller.php  | 30 ++++++++++++++-----
 2 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index 7068bc7dbd56f..caba883f1ccd4 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -2364,19 +2364,7 @@ protected function get_attachment_filename( int $attachment_id ): ?string {
 	protected function get_attachment_filesize( int $attachment_id ): ?int {
 		$meta = wp_get_attachment_metadata( $attachment_id );
 
-		/*
-		 * Attachment metadata is untyped, so only trust a positive integer
-		 * value (including a digit-only string, as stored by some plugins).
-		 * Fall through to recompute the size from the file otherwise.
-		 */
-		if (
-			isset( $meta['filesize'] ) &&
-			(
-				is_int( $meta['filesize'] ) ||
-				( is_string( $meta['filesize'] ) && ctype_digit( $meta['filesize'] ) )
-			) &&
-			$meta['filesize'] > 0
-		) {
+		if ( isset( $meta['filesize'] ) && is_numeric( $meta['filesize'] ) && $meta['filesize'] > 0 ) {
 			return (int) $meta['filesize'];
 		}
 
diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index e624316a7f868..e5e0ba6e5a7b6 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1006,15 +1006,20 @@ public function test_get_item() {
 	}
 
 	/**
-	 * Ensures a numeric-string `filesize` in attachment metadata is normalized
+	 * Ensures int-castable `filesize` values in attachment metadata are normalized
 	 * to an integer in the response.
 	 *
 	 * Attachment metadata is untyped, so plugins that populate `filesize` from
 	 * a remote storage API may store it as a string.
 	 *
 	 * @ticket 65670
+	 *
+	 * @dataProvider data_valid_filesize_meta
+	 *
+	 * @param mixed $stored_filesize Valid `filesize` metadata value.
+	 * @param int   $actual_filesize Actual filesize.
 	 */
-	public function test_get_item_normalizes_numeric_string_filesize_meta() {
+	public function test_get_item_normalizes_numeric_string_filesize_meta( $stored_filesize, int $actual_filesize ) {
 		$attachment_id = self::factory()->attachment->create_object(
 			array(
 				'file'           => self::$test_file,
@@ -1025,7 +1030,7 @@ public function test_get_item_normalizes_numeric_string_filesize_meta() {
 
 		$meta             = wp_get_attachment_metadata( $attachment_id );
 		$meta             = is_array( $meta ) ? $meta : array();
-		$meta['filesize'] = '123456';
+		$meta['filesize'] = $stored_filesize;
 		$this->assertNotFalse( wp_update_attachment_metadata( $attachment_id, $meta ) );
 
 		$request  = new WP_REST_Request( 'GET', '/wp/v2/media/' . $attachment_id );
@@ -1034,7 +1039,21 @@ public function test_get_item_normalizes_numeric_string_filesize_meta() {
 
 		$this->assertIsArray( $data );
 		$this->assertSame( 200, $response->get_status() );
-		$this->assertSame( 123456, $data['filesize'] );
+		$this->assertSame( $actual_filesize, $data['filesize'] );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array<string, array{ 0: mixed, 1: int }>
+	 */
+	public function data_valid_filesize_meta(): array {
+		return array(
+			'integer string'      => array( '123456', 123456 ),
+			'float string'        => array( '123.4', 123 ),
+			'scientific notation' => array( '1e3', 1000 ),
+			'float'               => array( 123.0, 123 ),
+		);
 	}
 
 	/**
@@ -1083,9 +1102,6 @@ public function test_get_item_recovers_from_invalid_filesize_meta( $filesize ) {
 	public function data_invalid_filesize_meta(): array {
 		return array(
 			'non-numeric string'      => array( 'corrupt' ),
-			'float string'            => array( '123.4' ),
-			'scientific notation'     => array( '1e3' ),
-			'float'                   => array( 123.0 ),
 			'boolean'                 => array( true ),
 			'zero'                    => array( 0 ),
 			'zero string'             => array( '0' ),

From 7d71ec8de1b10d04ce26a5bce8e2a472e695eb82 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:28:10 -0700
Subject: [PATCH 18/27] Improve wording of since tag

---
 src/wp-includes/functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index b50a37ee1e91f..e078bfe8c51d8 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -3669,7 +3669,7 @@ function wp_filesize( $path ): int {
 	 * Filters the size of the file.
 	 *
 	 * @since 6.0.0
-	 * @since 7.1.0 Negative numbers are discarded in favor of zero.
+	 * @since 7.1.0 The return value is now always zero or greater.
 	 *
 	 * @param int    $size The result of PHP filesize on the file.
 	 * @param string $path Path to the file.

From 0808521c649951cdb323a809e140c6f824e2759f Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:28:34 -0700
Subject: [PATCH 19/27] Improve name of test method

---
 tests/phpunit/tests/rest-api/rest-attachments-controller.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index e5e0ba6e5a7b6..453eb9ab96e23 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1019,7 +1019,7 @@ public function test_get_item() {
 	 * @param mixed $stored_filesize Valid `filesize` metadata value.
 	 * @param int   $actual_filesize Actual filesize.
 	 */
-	public function test_get_item_normalizes_numeric_string_filesize_meta( $stored_filesize, int $actual_filesize ) {
+	public function test_get_item_normalizes_int_castable_filesize_meta( $stored_filesize, int $actual_filesize ) {
 		$attachment_id = self::factory()->attachment->create_object(
 			array(
 				'file'           => self::$test_file,

From ec081cb85bdaaecf32b7deb11aeb0801123441a3 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:29:54 -0700
Subject: [PATCH 20/27] Indicate that filesize may be null in REST API response

---
 .../rest-api/endpoints/class-wp-rest-attachments-controller.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index caba883f1ccd4..c7a1cfc88bd2c 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -1707,7 +1707,7 @@ public function get_item_schema() {
 
 		$schema['properties']['filesize'] = array(
 			'description' => __( 'Attachment file size in bytes.' ),
-			'type'        => 'integer',
+			'type'        => array( 'integer', 'null' ),
 			'context'     => array( 'view', 'edit' ),
 			'readonly'    => true,
 		);

From bd24dfd0737687a3fa14008987a5447082b6cc9c Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:30:38 -0700
Subject: [PATCH 21/27] Improve data provider name

---
 tests/phpunit/tests/functions/wpFilesize.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/phpunit/tests/functions/wpFilesize.php b/tests/phpunit/tests/functions/wpFilesize.php
index 7774f8fe53295..975d4ace5b6cf 100644
--- a/tests/phpunit/tests/functions/wpFilesize.php
+++ b/tests/phpunit/tests/functions/wpFilesize.php
@@ -59,7 +59,7 @@ public function test_wp_filesize_pre_wp_filesize_filter_negative(): void {
 	/**
 	 * @ticket 65670
 	 *
-	 * @dataProvider data_provider_test_wp_filesize_filter_invalid_value
+	 * @dataProvider data_wp_filesize_filter_invalid_value
 	 *
 	 * @param mixed $value
 	 */
@@ -73,7 +73,7 @@ public function test_wp_filesize_wp_filesize_filter_invalid_value( $value ): voi
 	 *
 	 * @return array<string, array{ 0: mixed }>
 	 */
-	public function data_provider_test_wp_filesize_filter_invalid_value(): array {
+	public function data_wp_filesize_filter_invalid_value(): array {
 		return array(
 			'negative' => array( -1 ),
 			'null'     => array( null ),

From 3d7ddf4a48121e456d44a2e5e6c6e95796fe0d1e Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:36:20 -0700
Subject: [PATCH 22/27] Add tests for numeric-string as wp_filesize and
 pre_wp_filesize filtered value

---
 src/wp-includes/functions.php                | 8 +++++---
 tests/phpunit/tests/functions/wpFilesize.php | 9 +++++++--
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index e078bfe8c51d8..a31534e4f2e7c 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -3652,13 +3652,15 @@ function wp_filesize( $path ): int {
 	 * Filters the result of wp_filesize() before the file_exists() PHP function is run.
 	 *
 	 * @since 6.0.0
-	 * @since 7.1.0 Negative values are now ignored, being treated the same as null.
+	 * @since 7.1.0 Negative values are now ignored, being treated the same as null. Numeric strings are cast to integers.
 	 *
 	 * @param null|int $size The unfiltered value. Returning a non-negative int from the callback bypasses the filesize call.
 	 * @param string   $path Path to the file.
 	 */
 	$size = apply_filters( 'pre_wp_filesize', null, $path );
-
+	if ( is_numeric( $size ) ) {
+		$size = (int) $size;
+	}
 	if ( is_int( $size ) && $size >= 0 ) {
 		return $size;
 	}
@@ -3669,7 +3671,7 @@ function wp_filesize( $path ): int {
 	 * Filters the size of the file.
 	 *
 	 * @since 6.0.0
-	 * @since 7.1.0 The return value is now always zero or greater.
+	 * @since 7.1.0 The return value is now always zero or greater. Numeric strings are cast to integers.
 	 *
 	 * @param int    $size The result of PHP filesize on the file.
 	 * @param string $path Path to the file.
diff --git a/tests/phpunit/tests/functions/wpFilesize.php b/tests/phpunit/tests/functions/wpFilesize.php
index 975d4ace5b6cf..098a6c589368d 100644
--- a/tests/phpunit/tests/functions/wpFilesize.php
+++ b/tests/phpunit/tests/functions/wpFilesize.php
@@ -20,15 +20,20 @@ public function test_wp_filesize(): void {
 
 	/**
 	 * @ticket 49412
+	 * @ticket 65670
 	 */
 	public function test_wp_filesize_filters(): void {
 		add_filter( 'wp_filesize', static fn () => 999 );
-
 		$this->assertSame( 999, wp_filesize( self::TEST_FILE ) );
 
-		add_filter( 'pre_wp_filesize', static fn () => 111 );
+		add_filter( 'wp_filesize', static fn () => '9991', 100 );
+		$this->assertSame( 9991, wp_filesize( self::TEST_FILE ) );
 
+		add_filter( 'pre_wp_filesize', static fn () => 111 );
 		$this->assertSame( 111, wp_filesize( self::TEST_FILE ) );
+
+		add_filter( 'pre_wp_filesize', static fn () => '2222', 100 );
+		$this->assertSame( 2222, wp_filesize( self::TEST_FILE ) );
 	}
 
 	/**

From f556a4472f65f14c12e80315d9878b2b9864d7eb Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:43:14 -0700
Subject: [PATCH 23/27] Clarify numeric value vs numeric string

---
 src/wp-includes/functions.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index a31534e4f2e7c..b1f892d0ba226 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -3652,7 +3652,7 @@ function wp_filesize( $path ): int {
 	 * Filters the result of wp_filesize() before the file_exists() PHP function is run.
 	 *
 	 * @since 6.0.0
-	 * @since 7.1.0 Negative values are now ignored, being treated the same as null. Numeric strings are cast to integers.
+	 * @since 7.1.0 Negative values are now ignored, being treated the same as null. Numeric values are cast to integers.
 	 *
 	 * @param null|int $size The unfiltered value. Returning a non-negative int from the callback bypasses the filesize call.
 	 * @param string   $path Path to the file.
@@ -3671,7 +3671,7 @@ function wp_filesize( $path ): int {
 	 * Filters the size of the file.
 	 *
 	 * @since 6.0.0
-	 * @since 7.1.0 The return value is now always zero or greater. Numeric strings are cast to integers.
+	 * @since 7.1.0 The return value is now always zero or greater. Numeric values are cast to integers.
 	 *
 	 * @param int    $size The result of PHP filesize on the file.
 	 * @param string $path Path to the file.

From 026c8f04fda8f747884530383456802e301bd4dc Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:56:22 -0700
Subject: [PATCH 24/27] Improve wording of wp_filesize() docblocks

State the zero-or-greater guarantee the same way in the function docblock
as in the wp_filesize hook docblock, rather than phrasing it two different
ways in one function.

Describe the pre_wp_filesize short-circuit as accepting a non-negative
number, since a non-negative numeric string bypasses the filesize call too.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/wp-includes/functions.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index b1f892d0ba226..a1b8dc934f791 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -3639,7 +3639,7 @@ function wp_get_ext_types() {
  * Wrapper for PHP filesize with filters and casting the result as an integer.
  *
  * @since 6.0.0
- * @since 7.1.0 The minimum integer now returnable is zero.
+ * @since 7.1.0 The return value is now always zero or greater.
  *
  * @link https://www.php.net/manual/en/function.filesize.php
  *
@@ -3654,7 +3654,7 @@ function wp_filesize( $path ): int {
 	 * @since 6.0.0
 	 * @since 7.1.0 Negative values are now ignored, being treated the same as null. Numeric values are cast to integers.
 	 *
-	 * @param null|int $size The unfiltered value. Returning a non-negative int from the callback bypasses the filesize call.
+	 * @param null|int $size The unfiltered value. Returning a non-negative number from the callback bypasses the filesize call.
 	 * @param string   $path Path to the file.
 	 */
 	$size = apply_filters( 'pre_wp_filesize', null, $path );

From 6122b777e72187a3df57fe247d27f9ff87579142 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 13:56:33 -0700
Subject: [PATCH 25/27] Add negative value test for pre_wp_filesize

---
 tests/phpunit/tests/functions/wpFilesize.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/phpunit/tests/functions/wpFilesize.php b/tests/phpunit/tests/functions/wpFilesize.php
index 098a6c589368d..577d206b1507b 100644
--- a/tests/phpunit/tests/functions/wpFilesize.php
+++ b/tests/phpunit/tests/functions/wpFilesize.php
@@ -34,6 +34,9 @@ public function test_wp_filesize_filters(): void {
 
 		add_filter( 'pre_wp_filesize', static fn () => '2222', 100 );
 		$this->assertSame( 2222, wp_filesize( self::TEST_FILE ) );
+
+		add_filter( 'pre_wp_filesize', static fn () => -100, 200 );
+		$this->assertSame( 9991, wp_filesize( self::TEST_FILE ) );
 	}
 
 	/**

From 866255d85a6e657b296e3691cdd65757f340ed7e Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 14:04:30 -0700
Subject: [PATCH 26/27] Add data provider for negative pre_wp_filesize filter
 values

Cover a negative int, a negative numeric string, and a negative float,
since the filtered value is now normalized with is_numeric() rather than
is_int() and each of those types reaches the sign check differently.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 tests/phpunit/tests/functions/wpFilesize.php | 21 ++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/tests/phpunit/tests/functions/wpFilesize.php b/tests/phpunit/tests/functions/wpFilesize.php
index 577d206b1507b..07a62ac2004aa 100644
--- a/tests/phpunit/tests/functions/wpFilesize.php
+++ b/tests/phpunit/tests/functions/wpFilesize.php
@@ -57,13 +57,30 @@ public function test_wp_filesize_pre_wp_filesize_filter_null(): void {
 
 	/**
 	 * @ticket 65670
+	 *
+	 * @dataProvider data_wp_filesize_pre_wp_filesize_filter_negative
+	 *
+	 * @param float|int|string $value Negative value returned by the filter.
 	 */
-	public function test_wp_filesize_pre_wp_filesize_filter_negative(): void {
-		add_filter( 'pre_wp_filesize', static fn () => -1 );
+	public function test_wp_filesize_pre_wp_filesize_filter_negative( $value ): void {
+		add_filter( 'pre_wp_filesize', static fn () => $value );
 
 		$this->assertSame( filesize( self::TEST_FILE ), wp_filesize( self::TEST_FILE ) );
 	}
 
+	/**
+	 * Data provider.
+	 *
+	 * @return array<string, array{ 0: float|int|string }>
+	 */
+	public function data_wp_filesize_pre_wp_filesize_filter_negative(): array {
+		return array(
+			'negative int'            => array( -1 ),
+			'negative numeric string' => array( '-1' ),
+			'negative float'          => array( -1.5 ),
+		);
+	}
+
 	/**
 	 * @ticket 65670
 	 *

From 7d682396f68fe7a3fd9e6cd18ce8f27fcdac8e59 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Tue, 21 Jul 2026 14:12:31 -0700
Subject: [PATCH 27/27] Improve param name

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../tests/rest-api/rest-attachments-controller.php        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index 453eb9ab96e23..2b277c11d96a7 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1016,10 +1016,10 @@ public function test_get_item() {
 	 *
 	 * @dataProvider data_valid_filesize_meta
 	 *
-	 * @param mixed $stored_filesize Valid `filesize` metadata value.
-	 * @param int   $actual_filesize Actual filesize.
+	 * @param mixed $stored_filesize   Valid `filesize` metadata value.
+	 * @param int   $expected_filesize Expected `filesize` value in the REST response after normalization.
 	 */
-	public function test_get_item_normalizes_int_castable_filesize_meta( $stored_filesize, int $actual_filesize ) {
+	public function test_get_item_normalizes_int_castable_filesize_meta( $stored_filesize, int $expected_filesize ) {
 		$attachment_id = self::factory()->attachment->create_object(
 			array(
 				'file'           => self::$test_file,
@@ -1039,7 +1039,7 @@ public function test_get_item_normalizes_int_castable_filesize_meta( $stored_fil
 
 		$this->assertIsArray( $data );
 		$this->assertSame( 200, $response->get_status() );
-		$this->assertSame( $actual_filesize, $data['filesize'] );
+		$this->assertSame( $expected_filesize, $data['filesize'] );
 	}
 
 	/**