Open
Description
Bug Description
phpcs only validates that the values of an array are sanitized
But it should check if array keys are sanitized too, since they can have any value and can be used for an attack in the same way as values are.
Minimal Code Snippet
$_POST['my-data'] = array( 'hello' => 'world' );
$my_data = array_map( 'sanitize_text_field', $_POST['my-data'] );
foreach ( $my_data as $key => $value ) {
// use $key here
}
Same applies when using map_deep
method too
Error Code
None
Environment
Question | Answer |
---|---|
PHP version | PHP 7.4.24 |
PHP_CodeSniffer version | 3.6.1 |
WPCS version | 2.3.0 |
WPCS install type | e.g. Composer global, Composer project local |
Tested Against develop
branch?
- I have verified the issue still exists in the
develop
branch of WPCS.