Automattic / Automattic/VIP-Coding-Standards

Inconsistent treatment of translated strings

未关闭
#593 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
PHP
星标
261
派生
44
平均合并
19 分钟
30 天内合并 PR
1

描述

## Bug Description

We seem to have some inconsistencies when looking at `_e()` and `_ex()` vs `echo __()` and `echo _x()`, for example. Note that none of these functions are escaped.

When the minimal code snippet below is checked with severity 5, only 2 violations for `__()` and `__x()` appear.

When it's severity 1, then violations for all 4 lines appear.

Screenshot 2020-10-26 at 11 48 11

Seems to originate from [this line](https://github.com/Automattic/VIP-Coding-Standards/blob/bfc7fc56e18bec55a3830de06d1d3be0443585dd/WordPress-VIP-Go/ruleset.xml#L222-L224) where we drop severity for some WPCS violations, as we apparently trust translations.

The [unsafe printing functions](https://github.com/WordPress/WordPress-Coding-Standards/blob/2f098354173a9e8487b0e8672fde8c526c7daf52/WordPress/Sniffs/Security/EscapeOutputSniff.php#L70-L73) are `_e()` and `_ex()` .

## Minimal Code Snippet

```php

## Tested Against `master` branch?

- [x] I have verified the issue still exists in the `master` branch of VIPCS.
- [x] I have verified the issue still exists in the `develop` branch of VIPCS.

贡献指南

打开贡献指南

调研方向

从 ruleset.xml 的第 222-224 行附近开始,并将其严重性处理方式与 WordPress/Sniffs/Security/EscapeOutputSniff.php 第 70-73 行附近的处理方式进行比较。在严重性为 1 和 5 时重现所提供的 PHP 代码片段,然后验证这四种翻译字符串情况对于报告的错误代码都得到一致处理。

由索引模型根据 Issue 内容生成。

评估

技术栈
php
领域
tooling
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。