-
-
Notifications
You must be signed in to change notification settings - Fork 493
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adding missing escaping check for <?=
#858
Changes from 1 commit
f8241bc
98df766
a31b188
3fcbdc7
37dfe31
e7d7477
fac73b2
73fd553
415a8b1
5b6e892
ba862f9
382e66f
2a912a5
dd1b6f0
0698ae1
a361850
b52d30c
fde244e
c8e48ec
60d3bf1
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -105,12 +105,24 @@ class WordPress_Sniffs_XSS_EscapeOutputSniff extends WordPress_Sniff { | |
'T_TRAIT_C' => true, // __TRAIT__ | ||
); | ||
|
||
/** | ||
* Status of short_open_tag feature | ||
* | ||
* @var bool | ||
*/ | ||
private $short_open_tag_enabled = true; | ||
|
||
/** | ||
* Returns an array of tokens this test wants to listen for. | ||
* | ||
* @return array | ||
*/ | ||
public function register() { | ||
// Check whether short_open_tag is disabled on PHP version < 5.4 (it''s enabled by default in later versions). | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
if ( true === version_compare(phpversion(), '5.4', '<' ) && false === (bool) ini_get( 'short_open_tag' ) ) { | ||
$this->short_open_tag_enabled = false; | ||
} | ||
|
||
$tokens = array( | ||
T_ECHO, | ||
T_PRINT, | ||
|
@@ -123,7 +135,7 @@ public function register() { | |
* In case open_short_tag is turned off, we can attempt to regex T_INLINE_HTML | ||
* which is how open short tags are being handled in that case. | ||
*/ | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
if ( false === $this->is_short_open_tag_enabled() ) { | ||
if ( false === $this->short_open_tag_enabled ) { | ||
$tokens[] = T_INLINE_HTML; | ||
} | ||
return $tokens; | ||
|
@@ -161,7 +173,7 @@ public function process_token( $stackPtr ) { | |
if ( in_array( $function, array( 'trigger_error', 'user_error' ), true ) ) { | ||
$end_of_statement = $this->phpcsFile->findEndOfStatement( $open_paren + 1 ); | ||
} | ||
} else if ( false === $this->is_short_open_tag_enabled() && T_INLINE_HTML === $this->tokens[ $stackPtr ]['code'] ) { | ||
} else if ( false === $this->short_open_tag_enabled && T_INLINE_HTML === $this->tokens[ $stackPtr ]['code'] ) { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Just noticed one last minor thingie: the first part of this Having said that, that also means that the property can be removed and turned into a local variable within the |
||
// Skip if no PHP short_open_tag is in the string. | ||
if ( false === strpos( $this->tokens[ $stackPtr ]['content'], '<?=' ) ) { | ||
return; | ||
|
@@ -439,18 +451,4 @@ protected function mergeFunctionLists() { | |
} | ||
} | ||
|
||
/** | ||
* Checks whether short_open_tag is enabled. | ||
* | ||
* Since PHP 5.4, <?= is always available. | ||
* | ||
* @return bool False if short_open_tag is not enabled, true otherwise | ||
*/ | ||
public function is_short_open_tag_enabled() { | ||
if ( true === version_compare(phpversion(), '5.4', '<' ) && false === (bool) ini_get( 'short_open_tag' ) ) { | ||
return false; | ||
} | ||
return true; | ||
} | ||
|
||
} // End class. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add a
@since
tag