WordPress / WordPress/theme-check
Sanitize checks fail if semi-colons are in strings
Open
Nobody has claimed this yet.
bug
help wanted
sanitize
- Dominant language
- PHP
- Stars
- 371
- Forks
- 113
- Avg merge
- 8m
- Merged PRs (30d)
- 5
Description
https://wordpress.org/support/topic/add_setting-check-can-fail-even-if-callback-specified
Example to trigger:
$wp_customize->add_setting('foofoo', array(
'foo'=>'string containing ; here',
'sanitize_callback'=>'bar'
) );
Workaround for now: move the string into a variable outside the function call:
$str = 'string containing ; here';
$wp_customize->add_setting('foofoo', array(
'foo'=>$str,
'sanitize_callback'=>'bar'
) );
Fix: Regex in customizer.php check needs to be more robust.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in customizer.php at the regex used by the sanitize checks, then reproduce the reported add_setting example with a semicolon inside a string. Update the check so that this valid input is handled while the sanitize_callback validation still works, and verify the workaround is no longer needed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100