WordPress / WordPress/WordPress-Coding-Standards

Check for including files with untrusted paths or filenames

Open
#462 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Extra Focus: Security Type: Enhancement
Dominant language
PHP
Stars
2.8k
Forks
521
Avg merge
5d 20h
Merged PRs (30d)
1

Description

locate_template(), get_template_part() and sometimes include() or require() are typically used to include templates. If your template name, file name or path contains any non-static data or can be filtered, you must validate it against directory traversal using validate_file() or by detecting the string “..”

See https://vip.wordpress.com/documentation/code-review-what-we-look-for/#including-files-with-untrusted-paths-or-filenames

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the issue's examples: locate_template(), get_template_part(), include(), require(), and validate_file(), then read the linked WordPress code-review guidance. Define which dynamic template names, filenames, and paths should be reported and how directory traversal is detected; completion requires coverage for the identified cases and behavior consistent with that guidance.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.