WordPress / WordPress/WordPress-Coding-Standards
Restricted functions used in callbacks
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
While debugging the AbstractFunctionRestrictionsSniff class, I realized that any restricted functions used as callbacks, i.e. within add_action(), call_user_func(), array_map() are completely ignored.
That makes this kind of sniff extremely easy to bypass and while this is not so much an issue for people who elect to use the WPCS, this will be an issue for the Theme Review Theme Check to sniffs project as in that case, theme authors won't have a choice and bypassing checks that way is something we'll need to guard against.
I'm investigating how we can solve this. /cc @grappler
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the AbstractFunctionRestrictionsSniff class and tracing how it handles direct restricted-function usage. Reproduce the gap with callbacks passed to add_action(), call_user_func(), and array_map(). Done means restricted functions used in those callback contexts are no longer ignored and the relevant sniff behavior is covered by tests, though no test file is named in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100