Automattic / Automattic/jetpack

Avoid accessing the superglobals directly

Open
#4,308 4 comments 0 reactions 0 assignees View on GitHub
[Pri] Low [Type] Good First Bug [Type] Janitorial General
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

With CodeClimate now setup, I went thru some of the items reported. I suggest going thru the security issues first.

https://codeclimate.com/github/Automattic/jetpack/issues?category=security

For starters it seems instead of accessing Superglobals directly we should be using `filter_input` or something similar. This comes up quite a bit.

http://php.net/manual/en/function.filter-input.php

Contributor guide

Open the contributing guide

Research direction

Start with the CodeClimate security report linked in the issue and inventory the direct superglobal accesses it identifies across Jetpack. Review PHP's filter_input documentation, then define completion as addressing the reported accesses consistently and verifying that the security findings are resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.