WordPress / WordPress/WordPress-Coding-Standards
Allow nested array_map()
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
Problem?
Assume $_POST['thing'] holds an array like so:
array(
'https://www.asite.com',
'https://www.bsite.com',
'https://www.csite.com',
)
Assume we want to store the $_POST['thing'] in a $var.
Thus we would naturally do this:
$var = array_map( 'esc_url_raw', array_map( 'wp_unslash', $_POST['thing'] ) )
WPCS Sniff, despite the calls to wp_unslash and esc_url_raw, throws the errors:
3 | ERROR | [ ] $_POST data not unslashed before sanitization. Use
| | wp_unslash() or similar
3 | ERROR | [ ] Detected usage of a non-sanitized input variable:
| | $_POST['thing']
But, as the code shows, we do indeed use wp_unslash and do sanitize.
Note that, if we do the following:
$var = array_map( 'esc_url_raw', $_POST['thing'] );
then only the error about missing wp_unslash is thrown, but sanitizitation passes fine
Solution
If possible, the solution would be that WPCS recognises the nested array_map with the unslash and the sanitize callback.
I think it should be clear from the above description that WPCS seems to recognise one-level array_map but not several nested array maps.
Additional context
I first commented on https://github.com/WordPress/WordPress-Coding-Standards/pull/1679#issuecomment-920838362 because I thought it is related, but it is too old/perhaps less related than I thought.
Sorry if this is somehow wrong in report or expected in behaviour.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the nested array_map() example from the issue and compare it with the one-level case that passes sanitization. Trace the WPCS sniff logic for wp_unslash() and sanitization callbacks; done means the nested form is recognized without either false-positive error, with regression coverage for both examples.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100