WordPress / WordPress/WordPress-Coding-Standards

[Feature Request] XSS/EscapeOutput: add ability to pass (auto)escaped Methods

Open
#1,176 36 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Focus: Security Type: Enhancement
Dominant language
PHP
Stars
2.8k
Forks
521
Avg merge
5d 20h
Merged PRs (30d)
1

Description

PHPCS 3.1, WPCS 0.13.0, PHP 5.6.30

A backslash used to indicate the global namespace prevents customAutoEscapedFunctions from being recognized.

I have a ruleset like this:

<?xml version="1.0"?>
<ruleset name="WordPress-Me">
  <rule ref="WordPress.XSS.EscapeOutput">
    <properties>
      <property name="customAutoEscapedFunctions" value="ESPN_AMP, AMP_HTML_Utils" type="array" />
    </properties>
  </rule>
</ruleset>

And some code like this:

public static function amp_additional_css_styles() {
  $css = 'color: black;';
  echo \ESPN_AMP::sanitize_meta_css( $css );
}

which generates this error:

 373 | ERROR | Expected next thing to be an escaping function (see Codex for 'Data Validation'), not '\'
     |       | (WordPress.XSS.EscapeOutput.OutputNotEscaped)

If I drop the backslash (\):

public static function amp_additional_css_styles() {
  $css = 'color: black;';
  echo ESPN_AMP::sanitize_meta_css( $css );
}

Then PHPCS no longer finds the error.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the WordPress.XSS.EscapeOutput rule and reproduce the issue with the shown customAutoEscapedFunctions ruleset and namespaced method call. Trace how the sniff recognizes configured escaping methods, then verify that the fully qualified call with a leading backslash is accepted while existing unescaped calls remain reported.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.