Skip to content

Conversation

brentwilson-clariio
Copy link

Related to #1722

Adds WordPress/Docs/Security/EscapeOutputStandard.xml with short description and invalid/valid examples (echo, printf).
Tested with:
vendor/bin/phpcs --standard=WordPress --generator=Text --sniffs=WordPress.Security.EscapeOutput

Copy link
Collaborator

@rodrigoprimo rodrigoprimo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for working on this PR, @brentwilson-clariio!

I haven't done a full review yet of this PR, but I have some initial remarks:

  • Could you please update this PR to apply all the applicable points that were raised in the review of #2591? Since that PR was reviewed first, it might be a good idea to wait until it is finalized before updating this PR, as more points discussed there might be relevant here as well.
  • Per the description in #1722, verifying calls for addError()/addWarning() helps identify what the sniff is checking. There are some exceptions, but typically the documentation will contain one <standard> and one <code_comparison> block per error/warning message. This sniff raises a few errors that are not covered in this PR, and I believe they should. For example:
    $this->phpcsFile->addError(
    'All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found interpolation in unescaped heredoc.',
    $current,
    'HeredocOutputNotEscaped'
    );

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants