Prevent `wc_get_chosen_shipping_method_ids` from causing fatal errors if chosen methods are not strings (#43869)

* Check for string values when updating chosen_shipping_methods session

* Ensure filtering woocommerce_shipping_chosen_method provides a string value

* Add changefile(s) from automation for the following project(s): woocommerce

---------

Co-authored-by: github-actions <github-actions@github.com>

plugins/woocommerce/changelog/43869-fix-43850-chosen-method-hardening

@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Prevent `wc_get_chosen_shipping_method_ids` from causing fatal errors if chosen methods are not strings.

plugins/woocommerce/includes/class-wc-ajax.php

@@ -288,6 +288,9 @@ class WC_AJAX {
 
 		if ( is_array( $posted_shipping_methods ) ) {
 			foreach ( $posted_shipping_methods as $i => $value ) {
+				if ( ! is_string( $value ) ) {
+					continue;
+				}
 				$chosen_shipping_methods[ $i ] = $value;
 			}
 		}
@@ -347,6 +350,9 @@ class WC_AJAX {
 
 		if ( is_array( $posted_shipping_methods ) ) {
 			foreach ( $posted_shipping_methods as $i => $value ) {
+				if ( ! is_string( $value ) ) {
+					continue;
+				}
 				$chosen_shipping_methods[ $i ] = $value;
 			}
 		}

plugins/woocommerce/includes/class-wc-checkout.php

@@ -751,7 +751,7 @@ class WC_Checkout {
 		);
 		// phpcs:enable WordPress.Security.NonceVerification.Missing
 
-		$skipped = array();
+		$skipped        = array();
 		$form_was_shown = isset( $_POST['woocommerce-process-checkout-nonce'] ); // phpcs:disable WordPress.Security.NonceVerification.Missing
 
 		foreach ( $this->get_checkout_fields() as $fieldset_key => $fieldset ) {
@@ -1020,6 +1020,9 @@ class WC_Checkout {
 
 		if ( is_array( $data['shipping_method'] ) ) {
 			foreach ( $data['shipping_method'] as $i => $value ) {
+				if ( ! is_string( $value ) ) {
+					continue;
+				}
 				$chosen_shipping_methods[ $i ] = $value;
 			}
 		}

plugins/woocommerce/includes/wc-cart-functions.php

@@ -395,6 +395,9 @@ function wc_get_chosen_shipping_method_ids() {
 	$method_ids     = array();
 	$chosen_methods = WC()->session->get( 'chosen_shipping_methods', array() );
 	foreach ( $chosen_methods as $chosen_method ) {
+		if ( ! is_string( $chosen_method ) ) {
+			continue;
+		}
 		$chosen_method = explode( ':', $chosen_method );
 		$method_ids[]  = current( $chosen_method );
 	}
@@ -407,7 +410,7 @@ function wc_get_chosen_shipping_method_ids() {
  * @since  3.2.0
  * @param  int   $key Key of package.
  * @param  array $package Package data array.
- * @return string|bool
+ * @return string|bool Either the chosen method ID or false if nothing is chosen yet.
  */
 function wc_get_chosen_shipping_method_for_package( $key, $package ) {
 	$chosen_methods = WC()->session->get( 'chosen_shipping_methods' );
@@ -495,7 +498,7 @@ function wc_get_default_shipping_method_for_package( $key, $package, $chosen_met
 	 * @param array  $rates   Shipping rates.
 	 * @param string $chosen_method Chosen method id.
 	 */
-	return apply_filters( 'woocommerce_shipping_chosen_method', $default, $package['rates'], $chosen_method );
+	return (string) apply_filters( 'woocommerce_shipping_chosen_method', $default, $package['rates'], $chosen_method );
 }
 
 /**

plugins/woocommerce/src/StoreApi/Utilities/CartController.php

@@ -878,6 +878,9 @@ class CartController {
 	 * @param string     $rate_id ID of the rate being chosen.
 	 */
 	public function select_shipping_rate( $package_id, $rate_id ) {
+		if ( ! is_string( $rate_id ) ) {
+			return;
+		}
 		$cart                        = $this->get_cart_instance();
 		$session_data                = wc()->session->get( 'chosen_shipping_methods' ) ? wc()->session->get( 'chosen_shipping_methods' ) : [];
 		$session_data[ $package_id ] = $rate_id;