WordPress / WordPress/WordPress-Coding-Standards
dont require sanitization for strpos and stripos
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
strpos and stripos also do not have to have sanitized variables, since they do not modify either (and its just useless to sanitize e.g. the HTTP_HOST when its only used in strpos)
Sniff::$unslashingSanitizingFunctions - akin how count(),... don't require sanitization as added here https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/1673
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting Sniff::$unslashingSanitizingFunctions and the related change in pull request 1673, especially how count() is excluded from sanitization checks. Confirm the existing behavior for strpos() and stripos(), then update the relevant coverage so these functions no longer require sanitized variables; done means the checks accept their use with values such as HTTP_HOST.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100