Skip to content

Unsanitized array keys not reported #2012

Open
@kkmuffme

Description

@kkmuffme

Bug Description

phpcs only validates that the values of an array are sanitized
But it should check if array keys are sanitized too, since they can have any value and can be used for an attack in the same way as values are.

Minimal Code Snippet

$_POST['my-data'] = array( 'hello' => 'world' );

$my_data = array_map( 'sanitize_text_field', $_POST['my-data'] );

foreach ( $my_data as $key => $value ) {
    // use $key here
}

Same applies when using map_deep method too

Error Code

None

Environment

Question Answer
PHP version PHP 7.4.24
PHP_CodeSniffer version 3.6.1
WPCS version 2.3.0
WPCS install type e.g. Composer global, Composer project local

Tested Against develop branch?

  • I have verified the issue still exists in the develop branch of WPCS.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions