humanmade / humanmade/coding-standards

Unescaped translations are not flagged by 'HM' standards

Open
#273 0 comments 0 reactions 0 assignees View on GitHub
phpcs
Dominant language
PHP
Stars
160
Forks
17
PR merge metrics
No merged PRs in 30d

Description

Unescaped output from WordPress translation functions is not being flagged by the full HM standards checks.

The `HM-Minimum` standard allows the use of unescaped translation functions (see [HM-Minimum/ruleset.xml#L57-L66](https://github.com/humanmade/coding-standards/blob/f73d9dc587242fa2dbe3f1889ee3cfea17afc13a/HM-Minimum/ruleset.xml#L57-L66)). The minimum standards are then imported into `HM` standards ([HM/ruleset.xml#L12-L13](https://github.com/humanmade/coding-standards/blob/f73d9dc587242fa2dbe3f1889ee3cfea17afc13a/HM/ruleset.xml#L12-L13)), but there are no other rules in the `HM` standard that check the output of these functions is escaped.

The following code should pass `HM-Minimum`, but fail `HM`. Currently, it passes both.

```
echo __( 'This should error', 'err' );
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.