WordPress / WordPress/WordPress-Coding-Standards
Check for including files with untrusted paths or filenames
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
locate_template(),get_template_part()and sometimesinclude()orrequire()are typically used to include templates. If your template name, file name or path contains any non-static data or can be filtered, you must validate it against directory traversal usingvalidate_file()or by detecting the string “..”
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the issue's examples: locate_template(), get_template_part(), include(), require(), and validate_file(), then read the linked WordPress code-review guidance. Define which dynamic template names, filenames, and paths should be reported and how directory traversal is detected; completion requires coverage for the identified cases and behavior consistent with that guidance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100