Automattic / Automattic/VIP-Coding-Standards
ProperEscapingFunctionSniff doesn't catch misuse of wp_json_encode
- Dominant language
- PHP
- Stars
- 261
- Forks
- 44
- Avg merge
- 19m
- Merged PRs (30d)
- 1
Description
## Bug Description
[ProperEscapingFunctionSniff](https://github.com/Automattic/VIP-Coding-Standards/blob/54ff2f355aa6bdf5d987636a8e4b817d91e32d5d/WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php#L20) is a great addition to WPCS. It isn't comprehensive, though.
One specific example that I ran into is that it won't catch improper use of `wp_json_encode()` like it does with other functions.
## Minimal Code Snippet
```html
```
## Error Code
`WordPressVIPMinimum.Security.ProperEscapingFunction`
Contributor guide
Research direction
Start by reading WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php and reproduce the minimal onerror examples from the issue. Compare how wp_json_encode is handled with esc_html; done when the misuse produces the WordPressVIPMinimum.Security.ProperEscapingFunction error in that context.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100