Skip to content

Commit

Permalink
XSS.EscapeOutput sniff: Fix issue #933 - namespace separators.
Browse files Browse the repository at this point in the history
This simple change means that namespace separators will be be ignored completely by the check for output escaping which fixes the immediate issue.

For a more thorough fix, the logic of the function would need to be refactored to take namespaced functions into account as well, but that's for another day.
  • Loading branch information
jrfnl committed Aug 7, 2017
1 parent 4a97ddd commit c1d43bf
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 0 deletions.
5 changes: 5 additions & 0 deletions WordPress/Sniffs/XSS/EscapeOutputSniff.php
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,11 @@ public function process_token( $stackPtr ) {
continue;
}

// Ignore namespace separators.
if ( T_NS_SEPARATOR === $this->tokens[ $i ]['code'] ) {
continue;
}

if ( T_OPEN_PARENTHESIS === $this->tokens[ $i ]['code'] ) {

if ( ! isset( $this->tokens[ $i ]['parenthesis_closer'] ) ) {
Expand Down
12 changes: 12 additions & 0 deletions WordPress/Tests/XSS/EscapeOutputUnitTest.inc
Original file line number Diff line number Diff line change
Expand Up @@ -225,3 +225,15 @@ echo 8 * 1.2; // Ok.
<?= $var['foo']; ?><!-- Bad. -->
<?= $var->foo ?><!-- Bad. -->
<?php

// Issue #933. OK.
function do_footer_nav() {
echo \wp_kses_post(
\genesis_get_nav_menu(
[
'menu_class' => 'menu genesis-nav-menu menu-footer',
'theme_location' => 'footer',
]
)
);
}

0 comments on commit c1d43bf

Please sign in to comment.