magento / magento/magento-coding-standard

Stricter Escape Checks

Open
#490 2 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement Progress: ready for grooming
Dominant language
PHP
Stars
375
Forks
165
PR merge metrics
No merged PRs in 30d

Description

### Description

Currently, there is no validation to ensure that the correct escaping methods are used in the right context. This allows incorrect or inconsistent escaping, leading to potential security vulnerabilities.

For example, the following incorrect usages are currently not flagged:

```html

escapeHtmlAttr('text') ?>

Link

var msg = '<?= $escaper->escapeHtml("alert('XSS')") ?>';
```

**Correct Usage:**

```html

escapeHtml('Safe Text') ?>

Link

var msg = '<?= $escaper->escapeJs("alert('XSS')") ?>';
```

### Expected Behavior

- The Magento Coding Standard should flag incorrect usage of escaping methods.
- It should recommend the appropriate escaping function based on the context:
- `escapeHtml()` → for content inside HTML tags.
- `escapeHtmlAttr()` → for attribute values.
- `escapeUrl()` → for URLs inside ``, ``, etc.
- `escapeJs()` → for escaping JavaScript content inside `` tags or inline JS handlers (`onclick`, `onmouseover`, etc.).
- Developers should be alerted when incorrect escaping is used.

### Benefits

- Improves security by reducing the risk of XSS vulnerabilities caused by improper escaping.
- Encourages best practices for secure and consistent code.
- Enhances code quality by enforcing correct escaping usage.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by locating the Magento Coding Standard rules that analyze escaping, then define how HTML content, attributes, URLs, script blocks, and inline handlers are distinguished; done means incorrect methods are flagged with the context-appropriate recommendation and covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
html, javascript, php
Domain
security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.