WordPress / WordPress/WordPress-Coding-Standards
WordPress.Security.NonceVerification.Missing not reported when using filter_input
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
Bug Description
When using filter_input with INPUT_GET or INPUT_POST or INPUT_COOKIE, it's like accessing the $_GET/$_POST superglobals.
Therefore a nonce validation is required.
Minimal Code Snippet
The issue happens when running this command:
./bin/phpcs --config-set installed_paths ../wpcs
... over a file containing this code:
// should report an error
$foo = filter_input( INPUT_POST, 'email', FILTER_SANITIZE_EMAIL );
update_option( 'abc', $foo, false );
// correctly reports an error:
$foo = $_POST['email'];
update_option( 'def', $foo, false );
Error Code
WordPress.Security.NonceVerification.Missing
Environment
| Question | Answer |
|---|---|
| PHP version | 7.4 |
| PHP_CodeSniffer version | 3.7.2 |
| WPCS version | 2.3.0 |
| WPCS install type | https://github.com/WordPress/WordPress-Coding-Standards#standalone |
Tested Against develop branch?
- I have verified the issue still exists in the
developbranch of WPCS.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the report with the provided ./bin/phpcs command and minimal PHP snippet, comparing filter_input(INPUT_POST/GET/COOKIE) with direct superglobal access. Trace the implementation of WordPress.Security.NonceVerification.Missing and its existing tests; done means filter_input access is reported consistently with the shown $_POST case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100