ci: add PHPCompatibilityWP sniff

Author: dannyvankooten

composer.json

@@ -27,7 +27,8 @@
         "phpstan/phpstan": "^2.1",
         "szepeviktor/phpstan-wordpress": "^2.0",
         "phpstan/extension-installer": "^1.4",
-        "wp-coding-standards/wpcs": "^3.0"
+        "wp-coding-standards/wpcs": "^3.0",
+        "phpcompatibility/phpcompatibility-wp": "^2.1"
     },
     "scripts": {
         "all-checks": [

phpcs.xml.dist

@@ -16,5 +16,11 @@
 		<exclude name="Squiz.Classes.ValidClassName.NotCamelCaps" />
 		<exclude name="PSR1.Methods.CamelCapsMethodName.NotCamelCaps" />
 	</rule>
+	<rule ref="WordPress.Security">
+		<exclude name="WordPress.Security.ValidatedSanitizedInput.InputNotSanitized"/>
+	</rule>
 	<rule ref="WordPress.DB"/>
+	<rule ref="WordPress.WP.I18n"/>
+	<rule ref="WordPress.NamingConventions"/>
+	<rule ref="PHPCompatibilityWP"/>
 </ruleset>

src/admin/class-admin.php

@@ -482,13 +482,14 @@ public function save_box_options($box_id, $post)
             return;
         }
 
+        // phpcs:disable WordPress.Security.NonceVerification
         // make sure options array is set
         if (! isset($_POST['boxzilla_box']) || ! is_array($_POST['boxzilla_box'])) {
             return;
         }
 
         // get new options from $_POST
-        $opts = $this->sanitize_box_options($_POST['boxzilla_box']);
+        $opts = $this->sanitize_box_options(wp_unslash($_POST['boxzilla_box']));
 
         // allow extensions to filter the saved options
         $opts = apply_filters('boxzilla_saved_options', $opts, $box_id);
@@ -498,7 +499,7 @@ public function save_box_options($box_id, $post)
 
         // update global settings if given
         if (! empty($_POST['boxzilla_global_settings'])) {
-            $raw_global_settings = $_POST['boxzilla_global_settings'];
+            $raw_global_settings = wp_unslash($_POST['boxzilla_global_settings']);
             $global_settings = get_option('boxzilla_settings', []);
             if (! is_array($global_settings)) {
                 $global_settings = [];
@@ -510,6 +511,8 @@ public function save_box_options($box_id, $post)
         }
 
         $this->flush_rules($box_id);
+
+        // phpcs:enable WordPress.Security.NonceVerification
     }
 
     /**

src/admin/views/metaboxes/box-option-controls.php

@@ -20,6 +20,7 @@
 ];
 
 $rule_options = apply_filters('boxzilla_rules_options', $rule_options);
+
 ?>
 <table class="form-table">
     <?php

src/class-loader.php

@@ -112,7 +112,7 @@ protected function match_patterns($string, array $patterns, $contains = false)
      */
     protected function get_request_url()
     {
-        return rtrim($_SERVER['REQUEST_URI'] ?? '', '/');
+        return rtrim(wp_unslash($_SERVER['REQUEST_URI'] ?? ''), '/');
     }
 
     /**
@@ -143,7 +143,7 @@ protected function match_rule($condition, $value, $qualifier = true)
 
             case 'is_referer':
                 if (! empty($_SERVER['HTTP_REFERER'])) {
-                    $referer = $_SERVER['HTTP_REFERER'];
+                    $referer = wp_unslash($_SERVER['HTTP_REFERER']);
                     $matched = $this->match_patterns($referer, $values, $qualifier === 'contains' || $qualifier === 'not_contains');
                 }
                 break;
@@ -303,7 +303,7 @@ public function print_boxes_content()
 
         echo '<div style="display: none;">';
         foreach ($boxes as $box) {
-            printf('<div id="boxzilla-box-%d-content">%s</div>', absint($box->ID), $box->get_content());
+            printf('<div id="boxzilla-box-%d-content">%s</div>', absint($box->ID), $box->get_content()); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
         }
         echo '</div>';
     }