Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release 2.3.3 #699

Merged
merged 18 commits into from
Sep 29, 2021
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
330dd4c
Update ruleset.xml to configure VariableAnalysis
gudmdharalds Jun 16, 2021
1d378b2
Fix XML linting issue
gudmdharalds Jun 16, 2021
777ca46
Bump VA to 2.11.1
rebeccahum Jun 22, 2021
f6a4a16
Merge pull request #690 from Automattic/update/variableanalysis-confi…
rebeccahum Jun 22, 2021
00838ae
Remove dbDelta Warning
BrookeDot Jun 24, 2021
75ece92
Account for dbDelta removal in rulesets and tests
rebeccahum Jun 28, 2021
e1eb7c9
Merge pull request #692 from Automattic/remove/dbDelta
rebeccahum Jun 28, 2021
c3a80f0
Downgrade WordPressVIPMinimum.Security.ProperEscapingFunction.htmlAtt…
rebeccahum Jun 30, 2021
3aab322
Merge pull request #693 from Automattic/downgrade_htmlAttrNotByEscHTML
rebeccahum Jun 30, 2021
843af79
Merge pull request #691 from Automattic/update_va_2.11.1
rebeccahum Jul 19, 2021
c64d6a7
PHPCS: enable caching
jrfnl Aug 4, 2021
475870e
Merge pull request #694 from Automattic/JRF/phpcs-enable-caching
rebeccahum Aug 4, 2021
e09c47a
Revert "Downgrade htmlAttrNotByEscHTML to a warning"
rebeccahum Sep 27, 2021
87fd946
ProperEscapingFunction: Upgrade htmlAttrNotByEscHTML to default sever…
rebeccahum Sep 27, 2021
82c3b37
Merge pull request #696 from Automattic/revert-693-downgrade_htmlAttr…
rebeccahum Sep 28, 2021
dad2e32
Merge pull request #697 from Automattic/rebecca/htmlAttrNotByEscHTML_…
rebeccahum Sep 28, 2021
e5d1c81
Add changelog for 2.3.3 release
rebeccahum Sep 28, 2021
8808483
Merge pull request #698 from Automattic/2.3.3-changelog
rebeccahum Sep 29, 2021
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions WordPress-VIP-Go/ruleset-test.inc
Original file line number Diff line number Diff line change
Expand Up @@ -253,10 +253,10 @@ $test = @in_array( $array, $needle, true ); // Error.

// WordPressVIPMinimum.Security.ProperEscapingFunction.htmlAttrNotByEscHTML
echo '<a href="' . esc_attr( $some_var ) . '"></a>'; // Error.
echo '<a title="' . esc_html( $some_var ) . '"></a>'; // Error.
echo '<a title="' . esc_html( $some_var ) . '"></a>'; // Warning.
echo '<a href="' . esc_url( $some_var ) . '"></a>'; // OK.
?><a href="<?php echo esc_attr( $some_var ); ?>">Hello</a> <!-- Error. -->
<a href="" class="<?php echo esc_html( $some_var); ?>">Hey</a> <!-- Error. -->
<a href="" class="<?php echo esc_html( $some_var); ?>">Hey</a> <!-- Warning. -->
<a href="<?php esc_url( $url );?>"></a> <!-- Ok. -->
<a title="<?php esc_attr( $url );?>"></a> <?php // Ok.

Expand Down
4 changes: 2 additions & 2 deletions WordPress-VIP-Go/ruleset-test.php
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,7 @@
188 => 1,
252 => 1,
255 => 1,
256 => 1,
258 => 1,
259 => 1,
318 => 1,
329 => 1,
334 => 1,
Expand Down Expand Up @@ -193,6 +191,8 @@
245 => 1,
246 => 1,
247 => 1,
256 => 1,
259 => 1,
265 => 1,
269 => 1,
273 => 1,
Expand Down
4 changes: 0 additions & 4 deletions WordPress-VIP-Go/ruleset.xml
Original file line number Diff line number Diff line change
Expand Up @@ -229,10 +229,6 @@
<rule ref="Generic.PHP.NoSilencedErrors">
<severity>1</severity>
</rule>
<rule ref="WordPressVIPMinimum.Security.ProperEscapingFunction.htmlAttrNotByEscHTML">
<!-- This is still safe, just sub-optimal-->
<severity>3</severity>
</rule>
<rule ref="WordPressVIPMinimum.Functions.RestrictedFunctions.is_multi_author_is_multi_author">
<severity>1</severity>
</rule>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -205,8 +205,8 @@ public function process_token( $stackPtr ) {

if ( $escaping_type === 'html' ) {
$message = 'Wrong escaping function. HTML attributes should be escaped by `esc_attr()`, not by `%s()`.';
$this->phpcsFile->addError( $message, $stackPtr, 'htmlAttrNotByEscHTML', $data );
return;
$this->phpcsFile->addWarning( $message, $stackPtr, 'htmlAttrNotByEscHTML', $data );
return; // Warning level because sub-optimal due to different filters, but still OK.
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,15 @@ echo '<a title="' . esc_attr( $some_var ) . '"></a>'; // OK.

echo "<a title='" . \esc_attr( $some_var ) . "'></a>"; // OK.

echo '<a title="' . esc_html_x( $some_var ) . '"></a>'; // Error.
echo '<a title="' . esc_html_x( $some_var ) . '"></a>'; // Warning.

echo "<a title='" . \esc_html( $some_var ) . "'></a>"; // Error.
echo "<a title='" . \esc_html( $some_var ) . "'></a>"; // Warning.

?>

<a href="<?php echo esc_attr( $some_var ); ?>">Hello</a> <!-- Error. -->

<a href="" class="<?php esc_html_e( $some_var); ?>">Hey</a> <!-- Error. -->
<a href="" class="<?php esc_html_e( $some_var); ?>">Hey</a> <!-- Warning. -->

<a href="<?php esc_url( $url );?>"></a> <!-- OK. -->

Expand Down Expand Up @@ -71,9 +71,9 @@ echo "<$tag> " , esc_attr( $test ) , "</$tag>"; // Error.
<?php echo "<div>" . $test . "</div>"; // OK.
echo "<{$tag}>" . esc_attr( $tag_content ) . "</{$tag}>"; // Error.
echo "<$tag" . ' >' . esc_attr( $tag_content ) . "</$tag>"; // Error.
echo '<div class=\'' . esc_html($class) . '\'>'; // Error.
echo "<div class=\"" . \esc_html__($class) . '">'; // Error.
echo "<div $someAttribute class=\"" . esc_html($class) . '">'; // Error.
echo '<div class=\'' . esc_html($class) . '\'>'; // Warning.
echo "<div class=\"" . \esc_html__($class) . '">'; // Warning.
echo "<div $someAttribute class=\"" . esc_html($class) . '">'; // Warning.
echo '<a href=\'' . esc_html($url) . '\'>'; // Error.
echo "<img src=\"" . esc_html($src) . '"/>'; // Error.
echo "<div $someAttributeName-url=\"" . esc_html($url) . '">'; // Error.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,7 @@ public function getErrorList() {
return [
3 => 1,
5 => 1,
15 => 1,
17 => 1,
21 => 1,
23 => 1,
33 => 1,
37 => 1,
41 => 1,
Expand All @@ -45,9 +42,6 @@ public function getErrorList() {
69 => 1,
72 => 1,
73 => 1,
74 => 1,
75 => 1,
76 => 1,
77 => 1,
78 => 1,
79 => 1,
Expand All @@ -66,7 +60,14 @@ public function getErrorList() {
* @return array <int line number> => <int number of warnings>
*/
public function getWarningList() {
return [];
return [
15 => 1,
17 => 1,
23 => 1,
74 => 1,
75 => 1,
76 => 1,
];
}

}
2 changes: 1 addition & 1 deletion WordPressVIPMinimum/ruleset-test.inc
Original file line number Diff line number Diff line change
Expand Up @@ -548,7 +548,7 @@ echo '<a href="{{href}}">{{{data}}}</div></a>'; // Warning.

// WordPressVIPMinimum.Security.ProperEscapingFunction
echo '<a href="' . esc_attr( $some_var ) . '"></a>'; // Error.
echo '<a title="' . esc_html( $some_var ) . '"></a>'; // Error.
echo '<a title="' . esc_html( $some_var ) . '"></a>'; // Warning.

// WordPressVIPMinimum.Security.StaticStrreplace
str_replace( 'foo', array( 'bar', 'foo' ), 'foobar' ); // Error.
Expand Down
2 changes: 1 addition & 1 deletion WordPressVIPMinimum/ruleset-test.php
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,6 @@
523 => 1,
525 => 1,
550 => 1,
551 => 1,
554 => 1,
569 => 1,
570 => 1,
Expand Down Expand Up @@ -290,6 +289,7 @@
535 => 1,
538 => 1,
545 => 1,
551 => 1,
559 => 1,
565 => 1,
589 => 1,
Expand Down