Automattic / Automattic/VIP-Coding-Standards
ProperEscapingFunctionSniff doesn't catch misuse of wp_json_encode
- 主要语言
- PHP
- 星标
- 261
- 派生
- 44
- 平均合并
- 19 分钟
- 30 天内合并 PR
- 1
描述
## Bug Description
[ProperEscapingFunctionSniff](https://github.com/Automattic/VIP-Coding-Standards/blob/54ff2f355aa6bdf5d987636a8e4b817d91e32d5d/WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php#L20) is a great addition to WPCS. It isn't comprehensive, though.
One specific example that I ran into is that it won't catch improper use of `wp_json_encode()` like it does with other functions.
## Minimal Code Snippet
```html
```
## Error Code
`WordPressVIPMinimum.Security.ProperEscapingFunction`
贡献指南
调研方向
首先阅读 WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php,并复现 issue 中最小的 onerror 示例。比较 wp_json_encode 与 esc_html 的处理方式;当误用在该上下文中产生 WordPressVIPMinimum.Security.ProperEscapingFunction 错误时即完成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- php
- 领域
- security, tooling
- Issue 类型
- 缺陷
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 活跃度
- 停滞
- 描述清晰度
- 描述清楚
- 新手友好度
- 48/100