ruleset.xml

<?xml version="1.0"?>
<ruleset name="HM-Minimum">
	<description>Minimum requirements for HM projects.</description>

	<exclude-pattern>node_modules/*</exclude-pattern>
	<exclude-pattern>vendor/*</exclude-pattern>

	<arg name="extensions" value="php" />

	<autoload>../HM/bootstrap.php</autoload>

	<!-- Check for PHP cross-version compatibility. -->
	<rule ref="PHPCompatibilityWP">
		<exclude name="PHPCompatibility.Miscellaneous.RemovedAlternativePHPTags.MaybeASPOpenTagFound" />
	</rule>

	<!--
		Rules based on WordPress-Core
	-->

	<!-- Disallow slow database queries -->
	<rule ref="HM.Performance.SlowMetaQuery" />
	<rule ref="HM.Performance.SlowOrderBy" />

	<!-- Require output is escaped. -->
	<!-- Note: we use our version of EscapeOutput to ignore error-reporting functions. -->
	<!-- <rule ref="WordPress.Security.EscapeOutput"> -->
	<rule ref="HM.Security.EscapeOutput">
		<properties>
			<property name="customEscapingFunctions" type="array">
				<element value="whitelist_html" />
				<element value="clean_html" />
			</property>
			<property name="customAutoEscapedFunctions" type="array">
				<!-- Allow all the built-in URL functions -->
				<element value="home_url" />
				<element value="get_home_url" />
				<element value="site_url" />
				<element value="get_site_url" />
				<element value="admin_url" />
				<element value="get_admin_url" />
				<element value="includes_url" />
				<element value="content_url" />
				<element value="plugins_url" />
				<element value="network_site_url" />
				<element value="network_home_url" />
				<element value="network_admin_url" />
				<element value="user_admin_url" />
				<element value="self_admin_url" />

				<!-- Other URL functions -->
				<element value="get_template_directory_uri" />
				<element value="get_theme_file_uri" />
				<element value="get_term_link" />
				<element value="wp_nonce_url" />

				<!--
					For the minimum standard, we're not treating translations
					as an attack vector.
				-->
				<element value="__" />
				<element value="_x" />
				<element value="_n" />
				<element value="_nx" />
				<element value="date_i18n" />
				<element value="number_format_i18n" />

				<!-- Other templating tags. -->
				<element value="paginate_links" />
				<element value="get_the_title" />
				<element value="get_post_gallery" /> <!-- with param 2 set to true, the default -->
			</property>
		</properties>
	</rule>

	<!-- Disallow use of __FILE__ in menu slugs, which exposes the filesystem's data. -->
	<rule ref="WordPress.Security.PluginMenuSlug" />
	<rule ref="WordPress.Security.PluginMenuSlug.Using__FILE__">
		<type>error</type>
	</rule>

	<!-- Disallow functions where WordPress has an alternative. -->
	<rule ref="WordPress.WP.AlternativeFunctions">
		<!-- ...but, allow some back in. -->
		<properties>
			<property name="exclude" type="array">
				<element value="file_get_contents" />
				<element value="file_system_read" />
				<element value="json_encode" />
				<element value="json_decode" />

				<!-- wp_parse_url() only exists for inconsistency in PHP <5.4 -->
				<element value="parse_url" />
			</property>
		</properties>
	</rule>
	<rule ref="WordPress.DB.RestrictedFunctions" />
	<rule ref="WordPress.DB.RestrictedClasses" />

	<!-- Disallow eval(). (From WordPress-Core) -->
	<rule ref="Squiz.PHP.Eval"/>
	<rule ref="Squiz.PHP.Eval.Discouraged">
		<type>error</type>
		<message>eval() is a security risk and is not allowed.</message>
	</rule>

	<!-- Disallow create_function() -->
	<rule ref="WordPress.PHP.RestrictedPHPFunctions"/>

	<!-- Disallow goto function. -->
	<rule ref="Generic.PHP.DiscourageGoto"/>
	<rule ref="Generic.PHP.DiscourageGoto.Found">
		<type>error</type>
		<message>The "goto" language construct should not be used.</message>
	</rule>

	<!-- Disallow querying more than 100 posts at once. -->
	<rule ref="WordPress.WP.PostsPerPage" />
	<rule ref="WordPress.WP.PostsPerPage.posts_per_page_numberposts">
		<type>error</type>
	</rule>
	<rule ref="WordPress.WP.PostsPerPage.posts_per_page_posts_per_page">
		<type>error</type>
	</rule>

	<!-- Disallow changing PHP's timezone. -->
	<rule ref="WordPress.DateTime.RestrictedFunctions">
		<properties>
			<!-- Allow other datetime functions, just not timezone. -->
			<property name="exclude" type="array">
				<element value="date" />
			</property>
		</properties>
	</rule>

	<!-- Disallow short PHP tags. (From WordPress-Core) -->
	<rule ref="Generic.PHP.DisallowShortOpenTag">
		<!-- But, allow short echo, which is now standard. -->
		<exclude name="Generic.PHP.DisallowShortOpenTag.EchoFound" />
	</rule>

	<!-- Disallow old-style PHP tags (e.g. ASP-style) -->
	<rule ref="Generic.PHP.DisallowAlternativePHPTags">
		<!-- Allow ASP-style tags that aren't tokenised. -->
		<exclude name="Generic.PHP.DisallowAlternativePHPTags.MaybeASPShortOpenTagFound" />
		<exclude name="Generic.PHP.DisallowAlternativePHPTags.MaybeASPOpenTagFound" />
	</rule>

	<!-- Require prepared SQL statements. -->
	<rule ref="WordPress.DB.PreparedSQL" />
	<rule ref="WordPress.DB.PreparedSQLPlaceholders" />

	<!-- Disallow BOM, which causes issues with headers being sent. (From WordPress-Core) -->
	<rule ref="Generic.Files.ByteOrderMark" />

	<!-- Disallow empty statements. -->
	<rule ref="Generic.CodeAnalysis.EmptyPHPStatement" />

	<!-- Require correct usage of WP's i18n functions. -->
	<rule ref="WordPress.WP.I18n">
		<!-- Ignore missing translator comments -->
		<exclude name="WordPress.WP.I18n.MissingTranslatorsComment" />

		<!-- Allow empty strings to be translated (e.g. space character) -->
		<exclude name="WordPress.WP.I18n.NoEmptyStrings" />

		<!--
			Allow unordered placeholders. It's not good style, but strictly
			speaking it's not a problem.
		-->
		<exclude name="WordPress.WP.I18n.UnorderedPlaceholdersText" />
		<exclude name="WordPress.WP.I18n.MixedOrderedPlaceholdersText" />
	</rule>

	<!--
		Rules based on WordPress-Extra
	-->
	<!-- Disallow "development" functions like var_dump/print_r/phpinfo -->
	<rule ref="WordPress.PHP.DevelopmentFunctions">
		<!-- Allow triggering errors for reporting purposes. -->
		<exclude name="WordPress.PHP.DevelopmentFunctions.error_log_error_log" />
		<exclude name="WordPress.PHP.DevelopmentFunctions.error_log_trigger_error" />

		<!-- Allow overriding the error handler. -->
		<exclude name="WordPress.PHP.DevelopmentFunctions.error_log_set_error_handler" />

		<!-- Allow changing error level. -->
		<exclude name="WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting" />

		<!-- Allow backtraces. -->
		<exclude name="WordPress.PHP.DevelopmentFunctions.error_log_debug_backtrace" />
		<exclude name="WordPress.PHP.DevelopmentFunctions.error_log_wp_debug_backtrace_summary" />

		<!-- Set remaining to errors. -->
		<type>error</type>
	</rule>
	<!-- Override message for clarity. -->
	<rule ref="WordPress.PHP.DevelopmentFunctions.error_log_var_dump">
		<message>%s() found. Errors should be logged via error_log() or trigger_error().</message>
	</rule>
	<rule ref="WordPress.PHP.DevelopmentFunctions.error_log_var_export">
		<message>%s() found. Errors should be logged via error_log() or trigger_error().</message>
	</rule>
	<rule ref="WordPress.PHP.DevelopmentFunctions.error_log_print_r">
		<message>%s() found. Errors should be logged via error_log() or trigger_error().</message>
	</rule>
	<rule ref="WordPress.PHP.DevelopmentFunctions.error_log_debug_print_backtrace">
		<message>%s() found. Use error_log( wp_debug_backtrace_summary() ) instead.</message>
	</rule>

	<!-- Disallow a bunch of functions which change config. -->
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions">
		<properties>
			<property name="exclude" type="array">
				<!-- Allow serializing -->
				<element value="serialize" />

				<!-- Allow base64 encoding -->
				<element value="obfuscation" />

				<!-- Allow regular URL encoding -->
				<element value="urlencode" />
			</property>
		</properties>

		<!-- Allow changing error level. -->
		<exclude name="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_error_reporting" />

		<!-- Set all to errors. -->
		<type>error</type>
	</rule>

	<!-- Disallow parts of WP which have been deprecated. -->
	<rule ref="WordPress.WP.DeprecatedFunctions" />
	<rule ref="WordPress.WP.DeprecatedClasses" />
	<rule ref="WordPress.WP.DeprecatedParameters" />
	<rule ref="WordPress.WP.DeprecatedParameterValues" />

	<!-- Disallow parts of WP which have better alternatives. -->
	<rule ref="WordPress.WP.DiscouragedConstants" />
	<rule ref="WordPress.WP.DiscouragedFunctions">
		<properties>
			<property name="exclude" type="array">
				<!--
					wp_reset_query() does a different thing to
					wp_reset_postdata() and should not be discouraged.
				-->
				<element value="wp_reset_query" />
			</property>
		</properties>
	</rule>

	<!-- Disallow the backtick operator (which calls out to the system). -->
	<rule ref="Generic.PHP.BacktickOperator" />

	<!-- Require valid syntax. -->
	<rule ref="Generic.PHP.Syntax" />

	<!-- Disallow silencing errors. -->
	<rule ref="WordPress.PHP.NoSilencedErrors" />
	<rule ref="WordPress.PHP.NoSilencedErrors.Discouraged">
		<message>Errors should not be silenced. Found: %s</message>
	</rule>

	<!--
		Based on WordPress-VIP
	-->
	<!-- Require nonce verification. -->
	<rule ref="HM.Security.NonceVerification">
		<properties>
			<property name="allowQueryVariables" value="true" />
		</properties>
	</rule>

	<!-- Validate sanitised input. -->
	<rule ref="HM.Security.ValidatedSanitizedInput">
		<properties>
			<property name="customUnslashingSanitizingFunctions" type="array">
				<!-- Allow checking nonces without sanitization. -->
				<element value="wp_verify_nonce" />
			</property>

			<property name="customSanitizingFunctions" type="array">
				<!--
					Decoding isn't technically a sanitisation function,
					however you can't really sanitize JSON input.
				-->
				<element value="json_decode" />

				<!-- wp_trim_words() uses wp_strip_all_tags() internally. -->
				<element value="wp_trim_words" />
			</property>
		</properties>
	</rule>
	<rule ref="HM.Security.ValidatedSanitizedInput.MissingUnslash">
		<message>%s data not unslashed before sanitization. Use wp_unslash()</message>
	</rule>
</ruleset>