Skip to content

Commit b4fb6ba

Browse files
committed
ValidatedSanitizedInput: make the error messages more informative
This changes two things: 1. For both the `InputNotValidated` as well as the `InputNotSanitized` error, it will now display the array keys for the variable triggering the error. Previously, the message would just say `$_POST`, now it will say `$_POST['foo']['bar']`. 2. For the `InputNotValidated`, the error message text has been expanded to make it more obvious how to fix this issue. Fixes 1541
1 parent 33b55fe commit b4fb6ba

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

WordPress/Sniffs/Security/ValidatedSanitizedInputSniff.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,12 +129,12 @@ function ( $symbol ) {
129129
return;
130130
}
131131

132-
$error_data = array( $this->tokens[ $stackPtr ]['content'] );
132+
$error_data = array( $this->tokens[ $stackPtr ]['content'] . '[' . implode( '][', $array_keys ) . ']' );
133133

134134
// Check for validation first.
135135
if ( ! $this->is_validated( $stackPtr, $array_keys, $this->check_validation_in_scope_only ) ) {
136136
$this->phpcsFile->addError(
137-
'Detected usage of a non-validated input variable: %s',
137+
'Detected usage of a possibly undefined superglobal array index: %s. Use isset() or empty() to check the index exists before using it',
138138
$stackPtr,
139139
'InputNotValidated',
140140
$error_data

0 commit comments

Comments
 (0)