From 0d90eefd17c2d1d599a942e5ff003bf80f78a775 Mon Sep 17 00:00:00 2001
From: Jason Kenison <jason.kenison@gmail.com>
Date: Tue, 26 Aug 2025 15:26:35 -0700
Subject: [PATCH 1/3] initial commit for PluginMenuSlugStandard

---
 .../Docs/Security/PluginMenuSlugStandard.xml  | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 WordPress/Docs/Security/PluginMenuSlugStandard.xml

diff --git a/WordPress/Docs/Security/PluginMenuSlugStandard.xml b/WordPress/Docs/Security/PluginMenuSlugStandard.xml
new file mode 100644
index 0000000000..14ef86e6a4
--- /dev/null
+++ b/WordPress/Docs/Security/PluginMenuSlugStandard.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<documentation xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://phpcsstandards.github.io/PHPCSDevTools/phpcsdocs.xsd"
+    title="Plugin Menu Slug"
+    >
+    <standard>
+    <![CDATA[
+    Plugin functions which can be used to add pages to the WP Admin menu should not include `__FILE__` for page registration.
+    ]]>
+    </standard>
+    <code_comparison>
+        <code title="Valid: Slug does not include `__FILE__`.">
+        <![CDATA[
+add_menu_page(
+    'My Plugin Main Page',
+    'My Plugin',
+    'manage_options',
+    <em>my-plugin-main</em>,
+    'my_plugin_main_page'
+);
+        ]]>
+        </code>
+        <code title="Invalid: Slug includes `__FILE__`.">
+        <![CDATA[
+add_menu_page(
+    'My Plugin Main Page',
+    'My Plugin',
+    'manage_options',
+    <em>__FILE__</em>,
+    'my_plugin_main_page'
+);
+        ]]>
+        </code>
+    </code_comparison>
+</documentation>

From c4f55f32ba41ada4a7ab82197aeefe7b336af57e Mon Sep 17 00:00:00 2001
From: Jason Kenison <jason.kenison@gmail.com>
Date: Tue, 2 Sep 2025 09:09:22 -0700
Subject: [PATCH 2/3] updated description and added add_submenu_page examples

---
 .../Docs/Security/PluginMenuSlugStandard.xml  | 22 +++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/WordPress/Docs/Security/PluginMenuSlugStandard.xml b/WordPress/Docs/Security/PluginMenuSlugStandard.xml
index 14ef86e6a4..50be43077f 100644
--- a/WordPress/Docs/Security/PluginMenuSlugStandard.xml
+++ b/WordPress/Docs/Security/PluginMenuSlugStandard.xml
@@ -5,7 +5,7 @@
     >
     <standard>
     <![CDATA[
-    Plugin functions which can be used to add pages to the WP Admin menu should not include `__FILE__` for page registration.
+    Wordpress functions that can be used to add pages to the WP Admin menu should not include `__FILE__` for the menu slug (or parent menu slug) parameter to avoid revealing system paths.
     ]]>
     </standard>
     <code_comparison>
@@ -15,9 +15,18 @@ add_menu_page(
     'My Plugin Main Page',
     'My Plugin',
     'manage_options',
-    <em>my-plugin-main</em>,
+    <em>'my-plugin-main'</em>,
     'my_plugin_main_page'
 );
+
+add_submenu_page(
+    'my_plugin_main_page',
+    'My Plugin Subpage',
+    'Subpage',
+    'manage_options',
+    <em>'my-plugin-subpage'</em>,
+    'my_plugin_subpage'
+);
         ]]>
         </code>
         <code title="Invalid: Slug includes `__FILE__`.">
@@ -29,6 +38,15 @@ add_menu_page(
     <em>__FILE__</em>,
     'my_plugin_main_page'
 );
+
+add_submenu_page(
+    'my_plugin_main_page',
+    'My Plugin Subpage',
+    'Subpage',
+    'manage_options',
+    <em>__FILE__</em>,
+    'my_plugin_subpage'
+);
         ]]>
         </code>
     </code_comparison>

From 9c5d5516713d2c1a107b4e7d0a075be5b1e89451 Mon Sep 17 00:00:00 2001
From: Jason Kenison <jason.kenison@gmail.com>
Date: Tue, 2 Sep 2025 12:53:33 -0700
Subject: [PATCH 3/3] included example of concatination on parent

---
 WordPress/Docs/Security/PluginMenuSlugStandard.xml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/WordPress/Docs/Security/PluginMenuSlugStandard.xml b/WordPress/Docs/Security/PluginMenuSlugStandard.xml
index 50be43077f..9bdba1702d 100644
--- a/WordPress/Docs/Security/PluginMenuSlugStandard.xml
+++ b/WordPress/Docs/Security/PluginMenuSlugStandard.xml
@@ -20,11 +20,11 @@ add_menu_page(
 );
 
 add_submenu_page(
-    'my_plugin_main_page',
+    <em>'my_plugin_main_page'</em>,
     'My Plugin Subpage',
     'Subpage',
     'manage_options',
-    <em>'my-plugin-subpage'</em>,
+    'my-plugin-subpage',
     'my_plugin_subpage'
 );
         ]]>
@@ -35,16 +35,16 @@ add_menu_page(
     'My Plugin Main Page',
     'My Plugin',
     'manage_options',
-    <em>__FILE__</em>,
+    <em>__FILE__ . </em>'my-plugin-subpage',
     'my_plugin_main_page'
 );
 
 add_submenu_page(
-    'my_plugin_main_page',
+    <em>__FILE__ . </em>'my_plugin_main_page',
     'My Plugin Subpage',
     'Subpage',
     'manage_options',
-    <em>__FILE__</em>,
+    'my-plugin-subpage',
     'my_plugin_subpage'
 );
         ]]>