WordPress / WordPress/WordPress-Coding-Standards
[Feature Request] XSS/EscapeOutput: add ability to pass (auto)escaped Methods
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
PHPCS 3.1, WPCS 0.13.0, PHP 5.6.30
A backslash used to indicate the global namespace prevents customAutoEscapedFunctions from being recognized.
I have a ruleset like this:
<?xml version="1.0"?>
<ruleset name="WordPress-Me">
<rule ref="WordPress.XSS.EscapeOutput">
<properties>
<property name="customAutoEscapedFunctions" value="ESPN_AMP, AMP_HTML_Utils" type="array" />
</properties>
</rule>
</ruleset>
And some code like this:
public static function amp_additional_css_styles() {
$css = 'color: black;';
echo \ESPN_AMP::sanitize_meta_css( $css );
}
which generates this error:
373 | ERROR | Expected next thing to be an escaping function (see Codex for 'Data Validation'), not '\'
| | (WordPress.XSS.EscapeOutput.OutputNotEscaped)
If I drop the backslash (\):
public static function amp_additional_css_styles() {
$css = 'color: black;';
echo ESPN_AMP::sanitize_meta_css( $css );
}
Then PHPCS no longer finds the error.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the WordPress.XSS.EscapeOutput rule and reproduce the issue with the shown customAutoEscapedFunctions ruleset and namespaced method call. Trace how the sniff recognizes configured escaping methods, then verify that the fully qualified call with a leading backslash is accepted while existing unescaped calls remain reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100