Skip to content

Commit

Permalink
Security/NonceVerification: add test with PHP 8.1+ nested enum
Browse files Browse the repository at this point in the history
Just like other nested constructs, the search for a nonce check should limit itself to the current scope and skip over nested closed scopes/not look outside the current scope.

This is already handled correctly for enums due to the sniff using the PHPCSUtils `Collections::closedScopes()` method.

This just adds tests to safeguard this.
  • Loading branch information
jrfnl committed Jul 9, 2023
1 parent 2c587d8 commit 45aefb8
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 0 deletions.
27 changes: 27 additions & 0 deletions WordPress/Tests/Security/NonceVerificationUnitTest.1.inc
Original file line number Diff line number Diff line change
Expand Up @@ -459,3 +459,30 @@ function test_match() {
default => $_POST['key'], // OK, due to check above. Realistically, this is wrong, but that goes for all conditional checks.
};
}

function function_containing_nested_enum_with_nonce_check() {
enum MyEnum {
public function nested_method() {
wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['my_nonce'] ) ), 'the_nonce' );
}
}

echo $_POST['foo']; // Bad.
}

function function_containing_nested_enum_with_nonce_check_outside() {
wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['my_nonce'] ) ), 'the_nonce' );

enum MyEnum {
public function nested_method() {
echo $_POST['foo']; // Bad.
}
}
}

enum MyEnum {
public function nested_method() {
wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['my_nonce'] ) ), 'the_nonce' );
echo $_POST['foo']; // OK.
}
}
2 changes: 2 additions & 0 deletions WordPress/Tests/Security/NonceVerificationUnitTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,8 @@ public function getErrorList( $testFile = '' ) {
438 => 1,
448 => 1,
453 => 1,
470 => 1,
478 => 1,
);

case 'NonceVerificationUnitTest.2.inc':
Expand Down

0 comments on commit 45aefb8

Please sign in to comment.