WordPress / WordPress/WordPress-Coding-Standards

FILTER_SANITIZE_STRING is not a valid sanitization

Open
#2,018 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Focus: Security Type: Enhancement
Dominant language
PHP
Stars
2.8k
Forks
521
Avg merge
5d 20h
Merged PRs (30d)
1

Description

filter_input currently allows the use of FILTER_SANITIZE_STRING and does not report it as error for WordPress.Security.ValidatedSanitizedInput

However:
a) this is not a valid sanitization for some (most?) use cases (see b for why)
b) it's deprecated as of PHP 8.1 - see the discussion in PHP core, as for why this was deprecated.

There's a filter in WP VIP already for when FILTER_UNSAFE_RAW is used. We could also add the FILTER_SANITIZE_STRING there too instead. Just thought I report it here, as this is an issue here already (The question is rather: if we dont want to move the whole thing from VIP to "general", since the FILTER_UNSAFE_RAW usage is an issue in general WP, not just with VIP)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how WordPress.Security.ValidatedSanitizedInput handles filter_input and compare it with the existing FILTER_UNSAFE_RAW filter in WordPress VIP. Review the related tests if present; done means FILTER_SANITIZE_STRING is reported consistently or its handling is clearly moved into the intended general filter.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
devtools, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.