Skip to content

Commit

Permalink
EscapingFunctionsTrait: make sure function names are checked case-ins…
Browse files Browse the repository at this point in the history
…ensitively

These functions should be self-contained, so should not presume that the sniff has already lowercased the function name before passing it.

This fixes a bug as, in this case, the sniff didn't actually lowercase the name before passing it to the trait methods, so the sniff would throw false positives for non-lowercase function calls.

Tested by adjusting some pre-existing tests for the `EscapeOutput` sniff.
  • Loading branch information
jrfnl committed Jun 29, 2023
1 parent 31fa764 commit baf9512
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
4 changes: 2 additions & 2 deletions WordPress/Helpers/EscapingFunctionsTrait.php
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,7 @@ public function is_escaping_function( $functionName ) {
$this->addedCustomEscapingFunctions['escape'] = $this->customEscapingFunctions;
}

return isset( $this->allEscapingFunctions[ $functionName ] );
return isset( $this->allEscapingFunctions[ strtolower( $functionName ) ] );
}

/**
Expand All @@ -247,6 +247,6 @@ public function is_auto_escaped_function( $functionName ) {
$this->addedCustomEscapingFunctions['autoescape'] = $this->customAutoEscapedFunctions;
}

return isset( $this->allAutoEscapedFunctions[ $functionName ] );
return isset( $this->allAutoEscapedFunctions[ strtolower( $functionName ) ] );
}
}
4 changes: 2 additions & 2 deletions WordPress/Tests/Security/EscapeOutputUnitTest.inc
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ while ( have_posts() ) {
?>

<h2><?php echo $title; // Bad. ?></h2>
<h2><?php echo esc_html( $title ); // OK. ?></h2>
<h2><?php echo esc_HTML( $title ); // OK. ?></h2>
<h2><?php echo apply_filters( 'the_title', $title ); // Bad, no escaping function. ?></h2>

<?php
Expand Down Expand Up @@ -138,7 +138,7 @@ _doing_it_wrong( __METHOD__, "Invalid value for the 'bob' argument " . esc_html(
trigger_error( "There was an error: {$message}", E_USER_NOTICE ); // Bad.
trigger_error( "There was an error: " . esc_html( $message ), E_USER_NOTICE ); // Ok.

echo '<p>' . sprintf( esc_html__( 'Some text -> %sLink text%s', 'textdomain' ), '<a href="' . esc_url( add_query_arg( array( 'page' => 'my_page' ), admin_url( 'admin.php' ) ) ) . '">', '</a>' ). '</p>'; // Ok.
echo '<p>' . sprintf( esc_html__( 'Some text -> %sLink text%s', 'textdomain' ), '<a href="' . Esc_Url( add_query_arg( array( 'page' => 'my_page' ), admin_url( 'admin.php' ) ) ) . '">', '</a>' ). '</p>'; // Ok.

echo '<br/><strong>' . sprintf( esc_html__( 'Found %d results', 'textdomain' ), (int) $result_count ) . '</strong><br/><br/>'; // Ok.

Expand Down

0 comments on commit baf9512

Please sign in to comment.