Automattic / Automattic/VIP-Coding-Standards

ProperEscapingFunctionSniff doesn't catch misuse of wp_json_encode

Open
#876 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
261
Forks
44
Avg merge
19m
Merged PRs (30d)
1

Description

## Bug Description

[ProperEscapingFunctionSniff](https://github.com/Automattic/VIP-Coding-Standards/blob/54ff2f355aa6bdf5d987636a8e4b817d91e32d5d/WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php#L20) is a great addition to WPCS. It isn't comprehensive, though.

One specific example that I ran into is that it won't catch improper use of `wp_json_encode()` like it does with other functions.

## Minimal Code Snippet

```html


```

## Error Code

`WordPressVIPMinimum.Security.ProperEscapingFunction`

Contributor guide

Open the contributing guide

Research direction

Start by reading WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php and reproduce the minimal onerror examples from the issue. Compare how wp_json_encode is handled with esc_html; done when the misuse produces the WordPressVIPMinimum.Security.ProperEscapingFunction error in that context.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.