Fixes

Author: PDowney

.github/workflows/continuous-integration.yml

@@ -156,22 +156,10 @@ jobs:
           dependency-versions: highest
           composer-options: "--prefer-dist --no-progress"
 
-      - name: Install WordPress Coding Standards
+      - name: Verify PHPCS standards
         run: |
-          # Install PHPCS and WordPress Coding Standards using the dealerdirect installer
-          composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
-          composer global require --dev squizlabs/php_codesniffer:"^3.13.5"
-          composer global require --dev wp-coding-standards/wpcs:"^3.3"
-          composer global require --dev phpcompatibility/php-compatibility:"^9.3"
-          composer global require --dev phpcompatibility/phpcompatibility-wp:"^2.1" 
-          composer global require --dev automattic/vipwpcs:"^3.0.1"
-          composer global require --dev dealerdirect/phpcodesniffer-composer-installer:"^1.2"
-          
-          # Add composer bin to PATH
-          echo "$HOME/.composer/vendor/bin" >> $GITHUB_PATH
-          
-          # Verify installation and show available standards
-          phpcs -i
+          # Verify the project-local PHPCS installation and registered standards.
+          vendor/bin/phpcs -i
 
       - name: Run PHPCS
         run: |
@@ -433,8 +421,6 @@ jobs:
                   <directory name="." />
                   <ignoreFiles>
                       <directory name="vendor" />
-                      <directory name="tests" />
-                      <directory name="node_modules" />
                   </ignoreFiles>
               </projectFiles>
           </psalm>

.github/workflows/wp-compatibility-test.yml

@@ -307,7 +307,13 @@ function sse_write_engine_script_manifest( array $bundle_paths, string $site_ide
 		]
 	) . "\n";
 
-	if ( false === file_put_contents( $bundle_paths['manifest_path'], $manifest_content ) ) { // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- Writing generated local manifest into staging directory.
+	$filesystem_init = sse_init_filesystem();
+	if ( is_wp_error( $filesystem_init ) ) {
+		return $filesystem_init;
+	}
+
+	global $wp_filesystem;
+	if ( ! $wp_filesystem->put_contents( $bundle_paths['manifest_path'], $manifest_content, FS_CHMOD_FILE ) ) {
 		return new WP_Error( 'manifest_write_failed', __( 'Could not write EngineScript export manifest.', 'enginescript-site-exporter' ) );
 	}
 

includes/archive.php

@@ -16,16 +16,9 @@
  * @return string Client IP address or 'unknown' if not available.
  */
 function sse_get_client_ip(): string {
-	// WordPress-style IP detection with validation.
-	$client_ip = 'unknown';
+	$client_ip = filter_input( INPUT_SERVER, 'REMOTE_ADDR', FILTER_VALIDATE_IP );
 
-	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- $_SERVER['REMOTE_ADDR'] is safe for IP logging when properly sanitized
-	if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
-		$client_ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
-	}
-
-	// Basic IP validation.
-	if ( filter_var( $client_ip, FILTER_VALIDATE_IP ) !== false ) {
+	if ( is_string( $client_ip ) ) {
 		return $client_ip;
 	}
 
@@ -187,7 +180,7 @@ function sse_wp_die( string $message, int $response = 500 ): void {
 		esc_html( $message ),
 		'',
 		[
-			'response' => $response,
+			'response' => absint( $response ),
 		]
 	);
 }

includes/helpers.php

@@ -109,10 +109,11 @@
         <include-pattern>*\.php$</include-pattern>
     </rule>
 
-    <!-- PHPCSExtra rules for additional code quality checks -->
-    <rule ref="PHPCSExtra">
+    <!-- PHPCSExtra standards for additional code quality checks -->
+    <rule ref="Modernize">
         <exclude name="Modernize.FunctionCalls.Dirname.Nested"/>
     </rule>
+    <rule ref="NormalizedArrays"/>
 
     <!-- Set minimum WordPress version for deprecated function checks -->
     <config name="minimum_wp_version" value="6.8"/>

phpcs.xml

@@ -147,22 +147,4 @@
     <!-- For spacing enforcement, use PHPCS with WordPress standards instead -->
     <!-- This PHPMD config focuses on code quality and WordPress-compatible naming -->
 
-    <!-- Custom WordPress-specific rules -->
-    <rule name="WordPressSecurityRule"
-          message="Use WordPress sanitization functions for user input"
-          class="net.sourceforge.pmd.lang.rule.XPathRule">
-        <description>
-            Ensure WordPress sanitization functions are used for user input
-        </description>
-        <properties>
-            <property name="xpath">
-                <value>
-                //FunctionCall[FunctionName/@Image='$_GET' or FunctionName/@Image='$_POST' or FunctionName/@Image='$_REQUEST']
-                [not(ancestor::FunctionCall[FunctionName/@Image='sanitize_text_field' or FunctionName/@Image='wp_unslash' or FunctionName/@Image='esc_html' or FunctionName/@Image='esc_attr'])]
-                </value>
-            </property>
-        </properties>
-        <priority>2</priority>
-    </rule>
-
-</ruleset>
+</ruleset>