WordPress / WordPress/WordPress-Coding-Standards

Unsanitized array keys not reported

Open
#2,012 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Focus: Security Type: Enhancement
Dominant language
PHP
Stars
2.8k
Forks
521
Avg merge
5d 20h
Merged PRs (30d)
1

Description

Bug Description

phpcs only validates that the values of an array are sanitized
But it should check if array keys are sanitized too, since they can have any value and can be used for an attack in the same way as values are.

Minimal Code Snippet

$_POST['my-data'] = array( 'hello' => 'world' );

$my_data = array_map( 'sanitize_text_field', $_POST['my-data'] );

foreach ( $my_data as $key => $value ) {
    // use $key here
}

Same applies when using map_deep method too

Error Code

None

Environment

Question Answer
PHP version PHP 7.4.24
PHP_CodeSniffer version 3.6.1
WPCS version 2.3.0
WPCS install type e.g. Composer global, Composer project local

Tested Against develop branch?

  • I have verified the issue still exists in the develop branch of WPCS.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the minimal PHP snippet against the develop branch and trace the sniff that recognizes sanitized array values. Check the equivalent map_deep case as well. Done means unsanitized array keys are reported consistently with values, with regression coverage for both examples.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.