humanmade / humanmade/coding-standards
Unescaped translations are not flagged by 'HM' standards
- Dominant language
- PHP
- Stars
- 160
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
Unescaped output from WordPress translation functions is not being flagged by the full HM standards checks.
The `HM-Minimum` standard allows the use of unescaped translation functions (see [HM-Minimum/ruleset.xml#L57-L66](https://github.com/humanmade/coding-standards/blob/f73d9dc587242fa2dbe3f1889ee3cfea17afc13a/HM-Minimum/ruleset.xml#L57-L66)). The minimum standards are then imported into `HM` standards ([HM/ruleset.xml#L12-L13](https://github.com/humanmade/coding-standards/blob/f73d9dc587242fa2dbe3f1889ee3cfea17afc13a/HM/ruleset.xml#L12-L13)), but there are no other rules in the `HM` standard that check the output of these functions is escaped.
The following code should pass `HM-Minimum`, but fail `HM`. Currently, it passes both.
```
echo __( 'This should error', 'err' );
```
Contributor guide
Assessment
This issue has not been assessed yet.