magento / magento/magento-coding-standard
Stricter Escape Checks
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 375
- Forks
- 165
- PR merge metrics
- No merged PRs in 30d
Description
### Description
Currently, there is no validation to ensure that the correct escaping methods are used in the right context. This allows incorrect or inconsistent escaping, leading to potential security vulnerabilities.
For example, the following incorrect usages are currently not flagged:
```html
var msg = '<?= $escaper->escapeHtml("alert('XSS')") ?>';
```
**Correct Usage:**
```html
var msg = '<?= $escaper->escapeJs("alert('XSS')") ?>';
```
### Expected Behavior
- The Magento Coding Standard should flag incorrect usage of escaping methods.
- It should recommend the appropriate escaping function based on the context:
- `escapeHtml()` → for content inside HTML tags.
- `escapeHtmlAttr()` → for attribute values.
- `escapeUrl()` → for URLs inside ``, ``, etc.
- `escapeJs()` → for escaping JavaScript content inside `` tags or inline JS handlers (`onclick`, `onmouseover`, etc.).
- Developers should be alerted when incorrect escaping is used.
### Benefits
- Improves security by reducing the risk of XSS vulnerabilities caused by improper escaping.
- Encourages best practices for secure and consistent code.
- Enhances code quality by enforcing correct escaping usage.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by locating the Magento Coding Standard rules that analyze escaping, then define how HTML content, attributes, URLs, script blocks, and inline handlers are distinguished; done means incorrect methods are flagged with the context-appropriate recommendation and covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html, javascript, php
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100