You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+77Lines changed: 77 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,6 +8,82 @@ This projects adheres to [Semantic Versioning](https://semver.org/) and [Keep a
8
8
9
9
_No documentation available about unreleased changes as of yet._
10
10
11
+
## [2.1.0] - 2019-04-08
12
+
13
+
### Added
14
+
- New `WordPress.PHP.IniSet` sniff to the `WordPress-Extra` ruleset.
15
+
This sniff will detect calls to `ini_set()` and `ini_alter()` and warn against their use as changing configuration values at runtime leads to an unpredictable runtime environment, which can result in conflicts between core/plugins/themes.
16
+
- The sniff will not throw notices about a very limited set of "safe" ini directives.
17
+
- For a number of ini directives for which there are alternative, non-conflicting ways to achieve the same available, the sniff will throw an `error` and advise using the alternative.
18
+
-`doubleval()`, `count()` and `sizeof()` to `Sniff::$unslashingSanitizingFunctions` property.
19
+
While `count()` and its alias `sizeof()`, don't actually unslash or sanitize, the output of these functions is safe to use without unslashing or sanitizing.
20
+
This affects the `WordPress.Security.ValidatedSanitizedInput` and the `WordPress.Security.NonceVerification` sniffs.
21
+
- The new WP 5.1 `WP_UnitTestCase_Base` class to the `Sniff::$test_class_whitelist` property.
22
+
- New `Sniff::get_array_access_keys()` utility method to retrieve all array keys for a variable using multi-level array access.
23
+
- New `Sniff::is_class_object_call()`, `Sniff::is_token_namespaced()` utility methods.
24
+
These should help make the checking of whether or not a function call is a global function, method call or a namespaced function call more consistent.
25
+
This also implements allowing for the [namespace keyword being used as an operator](https://www.php.net/manual/en/language.namespaces.nsconstants.php#example-258).
26
+
- New `Sniff::is_in_function_call()` utility method to facilitate checking whether a token is (part of) a parameter passed to a specific (set of) function(s).
27
+
- New `Sniff::is_in_type_test()` utility method to determine if a variable is being type tested, along with a `Sniff::$typeTestFunctions` property containing the names of the functions this applies to.
28
+
- New `Sniff::is_in_array_comparison()` utility method to determine if a variable is (part of) a parameter in an array-value comparison, along with a `Sniff::$arrayCompareFunctions` property containing the names of the relevant functions.
29
+
- New `Sniff::$arrayWalkingFunctions` property containing the names of array functions which apply a callback to the array, but don't change the array by reference.
30
+
- New `Sniff::$unslashingFunctions` property containing the names of functions which unslash data passed to them and return the unslashed result.
31
+
32
+
### Changed
33
+
- Moved the `WordPress.PHP.StrictComparisons`, `WordPress.PHP.StrictInArray` and the `WordPress.CodeAnalysis.AssignmentInCondition` sniff from the `WordPress-Extra` to the `WordPress-Core` ruleset.
34
+
- The `Squiz.Commenting.InlineComment.SpacingAfter` error is no longer included in the `WordPress-Docs` ruleset.
35
+
- The default value for `minimum_supported_wp_version`, as used by a [number of sniffs detecting usage of deprecated WP features](https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/wiki/Customizable-sniff-properties#minimum-wp-version-to-check-for-usage-of-deprecated-functions-classes-and-function-parameters), has been updated to `4.8`.
36
+
- The `WordPress.WP.DeprecatedFunctions` sniff will now detect functions deprecated in WP 5.1.
37
+
- The `WordPress.Security.NonceVerification` sniff now allows for variable type testing, comparisons, unslashing and sanitization before the nonce check. A nonce check within the same scope, however, is still required.
38
+
- The `WordPress.Security.ValidatedSanitizedInput` sniff now allows for using a superglobal in an array-value comparison without sanitization, same as when the superglobal is used in a scalar value comparison.
39
+
-`WordPress.NamingConventions.PrefixAllGlobals`: some of the error messages have been made more explicit.
40
+
- The error messages for the `WordPress.Security.ValidatedSanitizedInput` sniff will now contain information on the index keys accessed.
41
+
- The error message for the `WordPress.Security.ValidatedSanitizedInput.InputNotValidated` has been reworded to make it more obvious what the actual issue being reported is.
42
+
- The error message for the `WordPress.Security.ValidatedSanitizedInput.MissingUnslash` has been reworded.
43
+
- The `Sniff::is_comparison()` method now has a new `$include_coalesce` parameter to allow for toggling whether the null coalesce operator should be seen as a comparison operator. Defaults to `true`.
44
+
- All sniffs are now also being tested against PHP 7.4 (unstable) for consistent sniff results.
45
+
- The recommended version of the suggested DealerDirect PHPCS Composer plugin is now `^0.5.0`.
46
+
- Various minor code tweaks and clean up.
47
+
48
+
### Removed
49
+
-`ini_set` and `ini_alter` from the list of functions detected by the `WordPress.PHP.DiscouragedFunctions` sniff.
50
+
These are now covered via the new `WordPress.PHP.IniSet` sniff.
51
+
-`in_array()` and `array_key_exists()` from the list of `Sniff::$sanitizingFunctions`. These are now handled differently.
52
+
53
+
### Fixed
54
+
- The `WordPress.NamingConventions.PrefixAllGlobals` sniff would underreport when global functions would be autoloaded via a Composer autoload `files` configuration.
55
+
- The `WordPress.Security.EscapeOutput` sniff will now recognize `map_deep()` for escaping the values in an array via a callback to an output escaping function. This should prevent false positives.
56
+
- The `WordPress.Security.NonceVerification` sniff will no longer inadvertently allow for a variable to be sanitized without a nonce check within the same scope.
57
+
- The `WordPress.Security.ValidatedSanitizedInput` sniff will no longer throw errors when a variable is only being type tested.
58
+
- The `WordPress.Security.ValidatedSanitizedInput` sniff will now correctly recognize the null coalesce (PHP 7.0) and null coalesce equal (PHP 7.4) operators and will now throw errors for missing unslashing and sanitization where relevant.
59
+
- The `WordPress.WP.AlternativeFunctions` sniff will no longer recommend using the WP_FileSystem when PHP native input streams, like `php://input`, or the PHP input stream constants are being read or written to.
60
+
- The `WordPress.WP.AlternativeFunctions` sniff will no longer report on usage of the `curl_version()` function.
61
+
- The `WordPress.WP.CronInterval` sniff now has improved function recognition which should lower the chance of false positives.
62
+
- The `WordPress.WP.EnqueuedResources` sniff will no longer throw false positives for inline jQuery code trying to access a stylesheet link tag.
63
+
- Various bugfixes for the `Sniff::has_nonce_check()` method:
64
+
- The method will no longer incorrectly identify methods/namespaced functions mirroring the name of WP native nonce verification functions as if they were the global functions.
65
+
This will prevent some false negatives.
66
+
- The method will now skip over nested closed scopes, such as closures and anonymous classes. This should prevent some false negatives for nonce verification being done while not in the correct scope.
67
+
68
+
These fixes affect the `WordPress.Security.NonceVerification` sniff.
69
+
- The `Sniff::is_in_isset_or_empty()` method now also checks for usage of `array_key_exist()` and `key_exists()` and will regard these as correct ways to validate a variable.
70
+
This should prevent false positives for the `WordPress.Security.ValidatedSanitizedInput` and the `WordPress.Security.NonceVerification` sniffs.
71
+
- Various bugfixes for the `Sniff::is_sanitized()` method:
72
+
- The method presumed the WordPress coding style regarding code layout, which could lead to false positives.
73
+
- The method will no longer incorrectly identify methods/namespaced functions mirroring the name of WP/PHP native unslashing/sanitization functions as if they were the global functions.
74
+
This will prevent some false negatives.
75
+
- The method will now recognize `map_deep()` for sanitizing an array via a callback to a sanitization function. This should prevent false positives.
76
+
- The method will now recognize `stripslashes_deep()` and `stripslashes_from_strings_only()` as valid unslashing functions. This should prevent false positives.
77
+
All these fixes affect both the `WordPress.Security.ValidatedSanitizedInput` and the `WordPress.Security.NonceVerification` sniff.
78
+
- Various bugfixes for the `Sniff::is_validated()` method:
79
+
- The method did not verify correctly whether a variable being validated was the same variable as later used which could lead to false negatives.
80
+
- The method did not verify correctly whether a variable being validated had the same array index keys as the variable as later used which could lead to both false negatives as well as false positives.
81
+
- The method now also checks for usage of `array_key_exist()` and `key_exists()` and will regard these as correct ways to validate a variable. This should prevent some false positives.
82
+
- The methods will now recognize the null coalesce and the null coalesce equal operators as ways to validate a variable. This prevents some false positives.
83
+
The results from the `WordPress.Security.ValidatedSanitizedInput` sniff should be more accurate because of these fixes.
84
+
- A potential "Undefined index" notice from the `Sniff::is_assignment()` method.
85
+
86
+
11
87
## [2.0.0] - 2019-01-16
12
88
13
89
### Important information about this release:
@@ -994,6 +1070,7 @@ See the comparison for full list.
0 commit comments