WordPress / WordPress/WordPress-Coding-Standards
InputNotSanitized should not report when doing numeric operations
Open
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
Bug Description
When using unsanitized input with numeric operations, wpcs should not report WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
Minimal Code Snippet
$request_duration = microtime( true ) - $_SERVER['REQUEST_TIME_FLOAT'];
Error Code
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
Environment
| Question | Answer |
|---|---|
| PHP version | 7.4.0 |
| WPCS version | 2.3.0 |
Tested Against develop branch?
- I have verified the issue still exists in the
developbranch of WPCS.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the reported InputNotSanitized warning with the minimal PHP snippet on the develop branch, using PHP 7.4 and WPCS 2.3.0 as the stated environment. Trace the WordPress.Security.ValidatedSanitizedInput.InputNotSanitized sniff and its existing tests, then verify that numeric operations no longer report this case while other unsanitized input cases remain covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100