WordPress / WordPress/WordPress-Coding-Standards
Setting cookie from cookie does not need to be sanitized
Open
Nobody has claimed this yet.
Focus: Security
Status: Needs investigation
Type: Enhancement
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
e.g. when resetting/increasing lifetime of a cookie
setcookie( $cookie, $_COOKIE[ $cookie ], time() + 86400, '/' )
setcookie( 'hello', $_COOKIE[ $cookie ], time() + 86400, '/' )
currently gives an error for WordPress.Security.ValidatedSanitizedInput
EDIT: use case: safari ITP HTTP cookie handling for JS cookies.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the WordPress.Security.ValidatedSanitizedInput report with the two setcookie examples in the issue, then trace the sniff or ruleset that handles cookie input. Confirm how cookie values reused in setcookie should be treated, and add or update coverage so the Safari ITP use case is represented and the intended check is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100