XSS sniff: improvements for printing function list #315
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This list was added in 722b2c6, as part of work on WordPress#33. The intention was to properly handle functions like `_e()` which generate direct output. However, for some reason we went overboard and added a bunch of l10n functions, most of which do not print output. I’m removing these non-printing functions.
After ff82f06, this clarifies the intent of this list.
We already do this with the lists of sanitizing and auto-escaped functions.
This has be `@todone`!
westonruter
added a commit
that referenced
this pull request
Feb 19, 2015
…funcs XSS sniff: improvements for printing function list
JDGrimes
added a commit
that referenced
this pull request
Apr 15, 2015
In #33, a list of localization functions like these were flagged as needing escaping. In #315 I amended this list, removing non-printing localization functions like `__()`, among other things. These changes caused a regression in the treatment of the `_e()` and `_ex()` functions, which remained on the list. They were previously flagged as needing escaping, even when their parameters were “safe” values (encapsed strings). That behavior was intentional, and was added because these functions incorporate other values into their final output, which need to be escaped before being printed. After #315, however, these functions themselves were not flagged, only their parameters when deemed unsafe (e.g., `_e( $var )`). This restores the previous behavior, by classifying these as ‘unsafe printing functions’, and flagging them as such when they are used. For performance, I’ve opted to skip checking the parameters of these functions when they are flagged, since the recommended replacements will remedy any issues there as well. If the error for the function itself is disabled though, any non-safe values incorporated into the parameters will still be flagged.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Several improvements for the list of printing functions in the XSS sniff.