Skip to content

Commit 2781d2c

Browse files
GaryJonesGaryJones
authored
Merge pull request #2709 from rodrigoprimo/validated-sanitized-input-tests
2 parents 273ae33 + 7022365 commit 2781d2c

2 files changed

Lines changed: 153 additions & 0 deletions

File tree

‎WordPress/Tests/Security/ValidatedSanitizedInputUnitTest.1.inc‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,3 +500,127 @@ function test_in_match_condition_is_regarded_as_comparison() {
500500
};
501501
}
502502
}
503+
504+
/*
505+
* Safeguard correct handling of qualified and relative namespaced calls to array key exists functions.
506+
* Non-namespaced and fully qualified calls are already covered above.
507+
*/
508+
function test_namespaced_array_key_exists() {
509+
if ( MyNamespace\array_key_exists( 'key_exists1', $_POST ) ) {
510+
$id = (int) $_POST['key_exists1']; // Bad.
511+
}
512+
if ( namespace\key_exists( 'key_exists2', $_POST ) ) {
513+
$id = (int) $_POST['key_exists2']; // Bad. Note: This should NOT be flagged in the future once the sniff is able to resolve relative namespaces.
514+
}
515+
if ( namespace\Sub\array_key_exists( 'key_exists3', $_POST ) ) {
516+
$id = (int) $_POST['key_exists3']; // Bad.
517+
}
518+
}
519+
520+
/*
521+
* Safeguard correct handling of all types of namespaced calls to type test functions.
522+
*/
523+
function test_namespaced_type_test_functions() {
524+
if ( isset( $_POST['type_test1'] ) && \is_int( $_POST['type_test1'] ) ) {} // OK.
525+
if ( isset( $_POST['type_test2'] ) && MyNamespace\is_string( $_POST['type_test2'] ) ) {} // Bad.
526+
if ( isset( $_POST['type_test3'] ) && \MyNamespace\is_array( $_POST['type_test3'] ) ) {} // Bad.
527+
if ( isset( $_POST['type_test4'] ) && namespace\is_numeric( $_POST['type_test4'] ) ) {} // Bad. Note: This should NOT be flagged in the future once the sniff is able to resolve relative namespaces.
528+
if ( isset( $_POST['type_test5'] ) && namespace\Sub\is_bool( $_POST['type_test5'] ) ) {} // Bad.
529+
}
530+
531+
/*
532+
* Safeguard correct handling of all types of namespaced calls to array comparison functions.
533+
*/
534+
function test_namespaced_array_comparison_functions() {
535+
if ( isset( $_POST['array_cmp1'] ) && \in_array( $_POST['array_cmp1'], $my_array, true ) ) {} // OK.
536+
if ( isset( $_POST['array_cmp2'] ) && MyNamespace\array_search( $_POST['array_cmp2'], $my_array, true ) ) {} // Bad.
537+
if ( isset( $_POST['array_cmp3'] ) && \MyNamespace\array_keys( $my_array, $_POST['array_cmp3'] ) ) {} // Bad.
538+
if ( isset( $_POST['array_cmp4'] ) && namespace\in_array( $_POST['array_cmp4'], $my_array, true ) ) {} // Bad. Note: This should NOT be flagged in the future once the sniff is able to resolve relative namespaces.
539+
if ( isset( $_POST['array_cmp5'] ) && namespace\Sub\array_search( $_POST['array_cmp5'], $my_array, true ) ) {} // Bad.
540+
}
541+
542+
/*
543+
* Safeguard correct handling of all types of namespaced calls to unslashing functions.
544+
*
545+
* Note: The "Bad" test cases below are false negatives. They should trigger 2 errors (MissingUnslash +
546+
* InputNotSanitized), not 1 (MissingUnslash). This problem only affects PHPCS 3.x and does not happen in PHPCS 4.x. It
547+
* will be addressed in https://github.com/WordPress/WordPress-Coding-Standards/issues/2665.
548+
*/
549+
function test_namespaced_unslashing_functions() {
550+
if ( isset( $_POST['unslash1'] ) ) {
551+
$text = sanitize_text_field( \wp_unslash( $_POST['unslash1'] ) ); // OK.
552+
}
553+
if ( isset( $_POST['unslash2'] ) ) {
554+
$text = sanitize_text_field( MyNamespace\stripslashes_deep( $_POST['unslash2'] ) ); // Bad.
555+
}
556+
if ( isset( $_POST['unslash3'] ) ) {
557+
$text = sanitize_text_field( \MyNamespace\stripslashes_from_strings_only( $_POST['unslash3'] ) ); // Bad.
558+
}
559+
if ( isset( $_POST['unslash4'] ) ) {
560+
$text = sanitize_text_field( namespace\wp_unslash( $_POST['unslash4'] ) ); // Bad. Note: This should NOT be flagged in the future once the sniff is able to resolve relative namespaces.
561+
}
562+
if ( isset( $_POST['unslash5'] ) ) {
563+
$text = sanitize_text_field( namespace\Sub\stripslashes_deep( $_POST['unslash5'] ) ); // Bad.
564+
}
565+
}
566+
567+
/*
568+
* Safeguard correct handling of all types of namespaced calls to array walking functions.
569+
*/
570+
function test_namespaced_array_walking_functions() {
571+
if ( isset( $_POST['array_walk1'] ) ) {
572+
$data = \array_map( 'sanitize_text_field', \wp_unslash( $_POST['array_walk1'] ) ); // OK.
573+
}
574+
if ( isset( $_POST['array_walk2'] ) ) {
575+
$data = MyNamespace\map_deep( wp_unslash( $_POST['array_walk2'] ), 'sanitize_text_field' ); // Bad.
576+
}
577+
if ( isset( $_POST['array_walk3'] ) ) {
578+
$data = \MyNamespace\array_map( 'sanitize_text_field', \wp_unslash( $_POST['array_walk3'] ) ); // Bad.
579+
}
580+
if ( isset( $_POST['array_walk4'] ) ) {
581+
$data = namespace\map_deep( wp_unslash( $_POST['array_walk4'] ), 'sanitize_text_field' ); // Bad. Note: This should NOT be flagged in the future once the sniff is able to resolve relative namespaces.
582+
}
583+
if ( isset( $_POST['array_walk5'] ) ) {
584+
$data = namespace\Sub\array_map( 'sanitize_text_field', \wp_unslash( $_POST['array_walk5'] ) ); // Bad.
585+
}
586+
}
587+
588+
/*
589+
* Safeguard correct handling of fully qualified and relative namespaced calls to sanitizing functions.
590+
* Qualified calls are already covered above.
591+
*/
592+
function test_namespaced_sanitizing_functions() {
593+
if ( isset( $_POST['sanitize1'] ) ) {
594+
$text = \sanitize_text_field( wp_unslash( $_POST['sanitize1'] ) ); // OK.
595+
}
596+
if ( isset( $_POST['sanitize2'] ) ) {
597+
$email = \MyNamespace\sanitize_email( wp_unslash( $_POST['sanitize2'] ) ); // Bad.
598+
}
599+
if ( isset( $_POST['sanitize3'] ) ) {
600+
$url = namespace\sanitize_url( wp_unslash( $_POST['sanitize3'] ) ); // Bad. Note: This should NOT be flagged in the future once the sniff is able to resolve relative namespaces.
601+
}
602+
if ( isset( $_POST['sanitize4'] ) ) {
603+
$title = namespace\Sub\sanitize_title( wp_unslash( $_POST['sanitize4'] ) ); // Bad.
604+
}
605+
}
606+
607+
/*
608+
* Safeguard correct handling of all types of namespaced calls to unslashing + sanitizing functions.
609+
*/
610+
function test_namespaced_unslashing_sanitizing_functions() {
611+
if ( isset( $_POST['unslash_sanitize1'] ) ) {
612+
$id = \absint( $_POST['unslash_sanitize1'] ); // OK.
613+
}
614+
if ( isset( $_POST['unslash_sanitize2'] ) ) {
615+
$is_active = MyNamespace\boolval( $_POST['unslash_sanitize2'] ); // Bad.
616+
}
617+
if ( isset( $_POST['unslash_sanitize3'] ) ) {
618+
$id = \MyNamespace\intval( $_POST['unslash_sanitize3'] ); // Bad.
619+
}
620+
if ( isset( $_POST['unslash_sanitize4'] ) ) {
621+
$price = namespace\floatval( $_POST['unslash_sanitize4'] ); // Bad. Note: This should NOT be flagged in the future once the sniff is able to resolve relative namespaces.
622+
}
623+
if ( isset( $_POST['unslash_sanitize5'] ) ) {
624+
$key = namespace\Sub\sanitize_key( $_POST['unslash_sanitize5'] ); // Bad.
625+
}
626+
}

‎WordPress/Tests/Security/ValidatedSanitizedInputUnitTest.php‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,35 @@ public function getErrorList( $testFile = '' ) {
114114
497 => 1,
115115
498 => 1,
116116
499 => 3,
117+
510 => 1,
118+
513 => 1,
119+
516 => 1,
120+
525 => 2,
121+
526 => 2,
122+
527 => 2,
123+
528 => 2,
124+
536 => 2,
125+
537 => 2,
126+
538 => 2,
127+
539 => 2,
128+
129+
// The error counts below differ depending on whether running PHPCS 3.x or PHPCS 4.x. See the comment in the test case file.
130+
554 => 1,
131+
557 => 1,
132+
560 => 1,
133+
563 => 1,
134+
135+
575 => 1,
136+
578 => 1,
137+
581 => 1,
138+
584 => 1,
139+
597 => 1,
140+
600 => 1,
141+
603 => 1,
142+
615 => 2,
143+
618 => 2,
144+
621 => 2,
145+
624 => 2,
117146
);
118147

119148
case 'ValidatedSanitizedInputUnitTest.2.inc':

0 commit comments

Comments
 (0)