WordPress / WordPress/plugin-check

Add check for changing error reporting configuration in plugin code

Open
#1,272 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Checks
Dominant language
PHP
Stars
362
Forks
126
Avg merge
1d 23h
Merged PRs (30d)
22

Description

Summary

Add a check that flags plugin code modifying global PHP/WordPress debug and error-reporting behavior at runtime.

Why

Changing error-reporting settings from plugin code can affect site-wide behavior and make debugging unreliable for site owners and other plugins.

Proposed check behavior

Flag these patterns:

  1. error_reporting(...)
  2. ini_set('error_reporting', ...)
  3. ini_set('display_errors', ...)
  4. ini_alter('error_reporting', ...)
  5. ini_alter('display_errors', ...)
  6. define('WP_DEBUG' | 'WP_DEBUG_LOG' | 'SCRIPT_DEBUG' | 'WP_DEBUG_DISPLAY', ...)

Expected severity

  • Type: bad practice / production safety
  • Severity: warning (or equivalent high-priority notice)

Acceptance criteria

  1. The check reports findings for all patterns above.
  2. Findings include file and line reference.
  3. Message clearly explains why this is discouraged in production plugin runtime.
  4. Tests exist for both positive and negative cases.

Test cases

Should trigger
  • error_reporting(0);
  • ini_set('display_errors', 1);
  • ini_alter('error_reporting', '0');
  • define('WP_DEBUG', true);
Should not trigger
  • Strings/comments that only mention these tokens.
  • Non-runtime examples/docs (if outside scan scope).

Inspired by Internal Scanner (calls-php_error).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the existing Internal Scanner check referenced as calls-php_error and the repository's current check tests. Add coverage for each listed runtime pattern and for strings/comments or other non-runtime examples that should not trigger. Done means findings include file and line references, use warning-level severity, explain the production risk, and pass positive and negative tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
tooling
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.