Skip to content

Commit

Permalink
PrintingFunctionsTrait: make sure function names are checked case-ins…
Browse files Browse the repository at this point in the history
…ensitively

These functions should be self-contained, so should not presume that the sniff has already lowercased the function name before passing it.

This fixes a bug as, in this case, the sniff didn't actually lowercase the name before passing it to the trait method, so the sniff would throw false negatives for non-lowercase function calls.

Tested by adjusting some pre-existing tests for the `EscapeOutput` sniff.
  • Loading branch information
jrfnl committed Jun 29, 2023
1 parent baf9512 commit 53309ac
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion WordPress/Helpers/PrintingFunctionsTrait.php
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,6 @@ public function is_printing_function( $functionName ) {
$this->addedCustomPrintingFunctions = $this->customPrintingFunctions;
}

return isset( $this->allPrintingFunctions[ $functionName ] );
return isset( $this->allPrintingFunctions[ strtolower( $functionName ) ] );
}
}
4 changes: 2 additions & 2 deletions WordPress/Tests/Security/EscapeOutputUnitTest.inc
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ echo $html_fragment; // WPCS: XSS whitelist.
?><?php echo $html_fragment; // XSS pass. ?><?php

_deprecated_function( __FUNCTION__, '1.3.0', 'another_func' ); // Ok.
_deprecated_function( __FUNCTION__, '1.3.0', $another_func ); // Bad.
_Deprecated_Function( __FUNCTION__, '1.3.0', $another_func ); // Bad.
_deprecated_function( __FUNCTION__, '1.3.0', esc_html( $another_func ) ); // Ok.
_deprecated_file( __FILE__, '1.3.0' ); // Ok.
_deprecated_argument( __METHOD__, '1.3.0', 'The $arg is deprecated.' ); // Ok.
Expand Down Expand Up @@ -261,7 +261,7 @@ echo esc_html_x( $some_nasty_var, 'context' ); // Ok.
echo PHP_VERSION_ID, PHP_VERSION, PHP_EOL, PHP_EXTRA_VERSION; // OK.

trigger_error( 'DEBUG INFO - ' . __METHOD__ . '::internal_domains: domain = ' . $domain ); // Bad.
trigger_error( $domain ); // Bad.
Trigger_ERROR( $domain ); // Bad.

vprintf( 'Hello %s', [ $foo ] ); // Bad.
vprintf( 'Hello %s', [ esc_html( $foo ) ] ); // Ok.
Expand Down

0 comments on commit 53309ac

Please sign in to comment.