WordPress / WordPress/WordPress-Coding-Standards
Unsanitized array keys not reported
Open
Nobody has claimed this yet.
Focus: Security
Type: Enhancement
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
Bug Description
phpcs only validates that the values of an array are sanitized
But it should check if array keys are sanitized too, since they can have any value and can be used for an attack in the same way as values are.
Minimal Code Snippet
$_POST['my-data'] = array( 'hello' => 'world' );
$my_data = array_map( 'sanitize_text_field', $_POST['my-data'] );
foreach ( $my_data as $key => $value ) {
// use $key here
}
Same applies when using map_deep method too
Error Code
None
Environment
| Question | Answer |
|---|---|
| PHP version | PHP 7.4.24 |
| PHP_CodeSniffer version | 3.6.1 |
| WPCS version | 2.3.0 |
| WPCS install type | e.g. Composer global, Composer project local |
Tested Against develop branch?
- I have verified the issue still exists in the
developbranch of WPCS.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the minimal PHP snippet against the develop branch and trace the sniff that recognizes sanitized array values. Check the equivalent map_deep case as well. Done means unsanitized array keys are reported consistently with values, with regression coverage for both examples.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100