Automattic / Automattic/VIP-Coding-Standards

WordPressVIPMinimum.Security.PHPFilterFunctions.MissingThirdParameter shouldn't report for SCRIPT_FILENAME,...

Open
#832 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
261
Forks
44
Avg merge
19m
Merged PRs (30d)
1

Description

## Bug Description

Since filter_input always acts on the original data, which can also not be modified in userland, all values that are specified by the SAPI itself are safe and do not need sanitizing.
These are:
https://github.com/php/php-src/blob/master/sapi/cli/php_cli.c#L330-L347
PHP_SELF
SCRIPT_NAME
SCRIPT_FILENAME
PATH_TRANSLATED
DOCUMENT_ROOT

For fpm these are provided by apache/nginx and no further validation is required, since PHP would not even process the request if any of those were invalid

## Minimal Code Snippet

```php
echo filter_input( INPUT_SERVER, 'DOCUMENT_ROOT' );
```

## Error Code

WordPressVIPMinimum.Security.PHPFilterFunctions.MissingThirdParameter

## Environment

VIPCS version | 3.0.1

## Tested Against `main` branch?

- [ ] I have verified the issue still exists in the `main` branch of VIPCS.
- [ ] I have verified the issue still exists in the `develop` branch of VIPCS.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.