Automattic / Automattic/VIP-Coding-Standards
WordPressVIPMinimum.Security.PHPFilterFunctions.MissingThirdParameter shouldn't report for SCRIPT_FILENAME,...
- Dominant language
- PHP
- Stars
- 261
- Forks
- 44
- Avg merge
- 19m
- Merged PRs (30d)
- 1
Description
## Bug Description
Since filter_input always acts on the original data, which can also not be modified in userland, all values that are specified by the SAPI itself are safe and do not need sanitizing.
These are:
https://github.com/php/php-src/blob/master/sapi/cli/php_cli.c#L330-L347
PHP_SELF
SCRIPT_NAME
SCRIPT_FILENAME
PATH_TRANSLATED
DOCUMENT_ROOT
For fpm these are provided by apache/nginx and no further validation is required, since PHP would not even process the request if any of those were invalid
## Minimal Code Snippet
```php
echo filter_input( INPUT_SERVER, 'DOCUMENT_ROOT' );
```
## Error Code
WordPressVIPMinimum.Security.PHPFilterFunctions.MissingThirdParameter
## Environment
VIPCS version | 3.0.1
## Tested Against `main` branch?
- [ ] I have verified the issue still exists in the `main` branch of VIPCS.
- [ ] I have verified the issue still exists in the `develop` branch of VIPCS.
Contributor guide
Assessment
This issue has not been assessed yet.