WordPress / WordPress/WordPress-Coding-Standards

Restricted functions used in callbacks

Open
#611 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Type: Bug Upstream: PHPCSUtils
Dominant language
PHP
Stars
2.8k
Forks
521
Avg merge
5d 20h
Merged PRs (30d)
1

Description

While debugging the AbstractFunctionRestrictionsSniff class, I realized that any restricted functions used as callbacks, i.e. within add_action(), call_user_func(), array_map() are completely ignored.

That makes this kind of sniff extremely easy to bypass and while this is not so much an issue for people who elect to use the WPCS, this will be an issue for the Theme Review Theme Check to sniffs project as in that case, theme authors won't have a choice and bypassing checks that way is something we'll need to guard against.

I'm investigating how we can solve this. /cc @grappler

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the AbstractFunctionRestrictionsSniff class and tracing how it handles direct restricted-function usage. Reproduce the gap with callbacks passed to add_action(), call_user_func(), and array_map(). Done means restricted functions used in those callback contexts are no longer ignored and the relevant sniff behavior is covered by tests, though no test file is named in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.