WordPress / WordPress/WordPress-Coding-Standards
XSS: Differentiate between functions and variables.
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
Split off from #744
With the following example we can be 100% sure that it is a correct error because it is a know WordPress function.
Expected next thing to be an escaping function (see Codex for 'Data Validation'), not 'home_url' (WordPress.XSS.EscapeOutput.OutputNotEscaped)
Another example would be the i18n functions. In WordPress core they are not being escaped. If we wanted to run WPCS on WordPress we would need to disable this sniff.
Expected next thing to be an escaping function (see Codex for 'Data Validation'), not '__' (WordPress.XSS.EscapeOutput.OutputNotEscaped)
This would be useful for the Theme Review Team. At the moment we have changed the notice from Error to Warning because there are too many false positives. There are a few results that we can completely trust and it would help to make those an error.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the WordPress.XSS.EscapeOutput.OutputNotEscaped sniff and compare its handling of the named functions home_url and __. Review the examples in this issue and determine how trusted WordPress functions should be distinguished from variables. Done means the sniff can reliably classify these cases and supports the Theme Review Team's need to treat trusted results differently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100