Search results

Escape output sniff fix for static method calls

Component: Core

Focus: Security

Status: Awaiting feedback

Type: Enhancement

Status: Open (in progress).

WordPress/WordPress-Coding-Standardsnumber 2370

#2370 In WordPress/WordPress-Coding-Standards;

· dingo-d opened on Aug 21, 2023

· Review required

5



Review SanitizationHelperTrait::is_only_sanitized() in depth

Component: Helpers

Focus: Security

Status: Needs investigation

Status: Open.

#2357 In WordPress/WordPress-Coding-Standards;

· jrfnl opened on Aug 18, 2023

Case where WordPress.Security.ValidatedSanitizedInput.InputNotSanitized might be a bit counter-intuitive

Focus: Security

Type: Bug

Status: Open.

#2246 In WordPress/WordPress-Coding-Standards;

· leonidasmi opened on May 29, 2023

10 comments

False positive: Allow trimming input before sanitizing

Focus: Security

Status: Awaiting feedback

Status: Invalid

Status: Open.

#2180 In WordPress/WordPress-Coding-Standards;

· Luc45 opened on Dec 23, 2022

5 comments

Critically review functions in Sniff::$autoEscapedFunctions list

Focus: Security

Status: Help wanted

Status: Needs investigation

Type: Chores/Cleanup

Status: Open.

#2119 In WordPress/WordPress-Coding-Standards;

· jrfnl opened on Dec 2, 2022

Add a check to recommend that the %i placeholders are used for identifier names instead of $wpdb->tablename or %1$s-like placeholders.

Component: Core

Focus: DB

Focus: Security

Status: Needs investigation

Type: Enhancement

Status: Open.

#2079 In WordPress/WordPress-Coding-Standards;

· craigfrancis opened on Aug 16, 2022

2 comments

Add a check to verify that the %i placeholders are used only for identifier names.

Component: Core

Focus: DB

Focus: Security

Status: Needs investigation

Type: Enhancement

Status: Open.

#2078 In WordPress/WordPress-Coding-Standards;

· craigfrancis opened on Aug 16, 2022

Setting cookie from cookie does not need to be sanitized

Focus: Security

Status: Needs investigation

Type: Enhancement

Status: Open.

#2019 In WordPress/WordPress-Coding-Standards;

· kkmuffme opened on Dec 1, 2021

FILTER_SANITIZE_STRING is not a valid sanitization

Focus: Security

Type: Enhancement

Status: Open.

#2018 In WordPress/WordPress-Coding-Standards;

· kkmuffme opened on Nov 30, 2021

1 comment

Calling ctype_alnum should count as sanitized input

Focus: Security

Type: Enhancement

Status: Open.

#2016 In WordPress/WordPress-Coding-Standards;

· kkmuffme opened on Nov 29, 2021

1 comment

Unsanitized array keys not reported

Focus: Security

Type: Enhancement

Status: Open.

#2012 In WordPress/WordPress-Coding-Standards;

· kkmuffme opened on Oct 27, 2021

Allow nested array_map()

Focus: Security

Type: Enhancement

Status: Open.

#2009 In WordPress/WordPress-Coding-Standards;

· smileBeda opened on Sep 16, 2021

1 comment

PreparedSQLPlaceholders.UnquotedComplexPlaceholder: allow for tablenames in backticks

Focus: DB

Focus: Security

Status: Needs investigation

Type: Enhancement

Status: Open.

#1903 In WordPress/WordPress-Coding-Standards;

· jrfnl opened on Jun 21, 2020

7 comments

Allow (s)printf to be used for sanitising/escaping

Component: Extra

Focus: Security

Type: Enhancement

Status: Open.

#1870 In WordPress/WordPress-Coding-Standards;

· rmccue opened on Feb 28, 2020

10 comments

Custom sanitizing rules ignored

Component: Helpers

Focus: Security

Type: Enhancement

Status: Open.

#1766 In WordPress/WordPress-Coding-Standards;

· paulschreiber opened on Jul 18, 2019

3 comments

Require "secure" cookies

Component: Extra

Focus: Security

Type: Enhancement

Status: Open.

#1704 In WordPress/WordPress-Coding-Standards;

· kkmuffme opened on May 13, 2019

6 comments

dont require sanitization for strpos and stripos

Focus: Security

Type: Enhancement

Status: Open.

#1691 In WordPress/WordPress-Coding-Standards;

· kkmuffme opened on Apr 9, 2019

7 comments

ValidatedSanitizedInput: allow use of array_keys() without sanitization/unslashing ?

Focus: Security

Type: Question

Status: Open.

#1672 In WordPress/WordPress-Coding-Standards;

· jrfnl opened on Mar 30, 2019

2 comments

Escaping sniff bug

Focus: Security

Status: Needs investigation

Type: Bug

Status: Open.

#1507 In WordPress/WordPress-Coding-Standards;

· GaryJones opened on Oct 18, 2018

5 comments

Add check for WP_UNINSTALL_PLUGIN

Focus: Security

Focus: WP interoperabilityDoing things the WP way, prefer using WP functionality over userland/PHP nativeDoing things the WP way, prefer using WP functionality over userland/PHP native

Status: Open.

#1338 In WordPress/WordPress-Coding-Standards;

· froger-me opened on Apr 22, 2018

3 comments

Allow prepared queries to be passed in via a variable

Component: Core

Focus: DB

Focus: Security

Status: Open.

#1331 In WordPress/WordPress-Coding-Standards;

· johnbillion opened on Mar 29, 2018

7 comments

Security: Recommend wp_safe_remote_*() when wp_remote_*() is used

Focus: Security

Type: Enhancement

Status: Open.

#1288 In WordPress/WordPress-Coding-Standards;

· JDGrimes opened on Jan 15, 2018

3 comments

Security: ensure second arg of wp_localize_script() is properly escaped

Component: Extra

Focus: Security

Type: Enhancement

Status: Open.

#1253 In WordPress/WordPress-Coding-Standards;

· JDGrimes opened on Dec 6, 2017

3 comments

[Feature Request] XSS/EscapeOutput: add ability to pass (auto)escaped Methods

Focus: Security

Type: Enhancement

Status: Open.

#1176 In WordPress/WordPress-Coding-Standards;

· paulschreiber opened on Oct 5, 2017

31 comments

Prepared SQL sniff: support array_map()

Focus: DB

Focus: Security

Type: Enhancement

Status: Open.

#1046 In WordPress/WordPress-Coding-Standards;

· Chouby opened on Jul 22, 2017

· 

Future Release

2 comments