Skip to content

Fix flagged PHPCS throughout codebase #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kadamwhite merged 7 commits into from
Jun 23, 2026
Merged

Fix flagged PHPCS throughout codebase #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3cd5b64
PHPCS: Add sanitization around unslashed $_GET property access
kadamwhite Jun 23, 2026
ce0175c
PHPCS: Add sanitization around unslashed $_GET property access
kadamwhite Jun 23, 2026
581e62c
PHPCS: Document deliberate manual sanitization of search input
kadamwhite Jun 23, 2026
76500c3
PHPCS: Keep strip_tags() for whitespace-preserving search sanitization
kadamwhite Jun 23, 2026
4bf9e0f
PHPCS: Adjust positioning of ignore directives for legibility
kadamwhite Jun 23, 2026
bfcccb0
Update HMCS to 2.2.1 to fix false-positive on get_block_wrapper_attri…
kadamwhite Jun 23, 2026
5a6fb7b
PHPCS: Fix misalignment of comment
kadamwhite Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions composer.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions inc/namespace.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,10 +179,12 @@ function render_block_search( string $block_content, array $block, \WP_Block $in
$action = str_replace( '/page/'. get_query_var( 'paged', 1 ), '', add_query_arg( [ $query_var => '' ] ) );

// Note sanitize_text_field trims whitespace from start/end of string causing unexpected behaviour.
// phpcs:ignore HM.Security.ValidatedSanitizedInput.InputNotSanitized
$value = wp_unslash( $_GET[ $query_var ] ?? '' );
$value = urldecode( $value );
$value = wp_check_invalid_utf8( $value );
$value = wp_pre_kses_less_than( $value );
// phpcs:ignore WordPress.WP.AlternativeFunctions.strip_tags_strip_tags -- need to preserve whitespace.
Comment thread
kadamwhite marked this conversation as resolved.
$value = strip_tags( $value );

wp_interactivity_state( 'query-filter', [
Expand Down
2 changes: 1 addition & 1 deletion src/post-type/render.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
<select class="wp-block-query-filter-post-type__select wp-block-query-filter__select" id="<?php echo esc_attr( $id ); ?>" data-wp-on--change="actions.navigate">
<option value="<?php echo esc_attr( $base_url ) ?>"><?php echo esc_html( $attributes['emptyLabel'] ?: __( 'All', 'query-filter' ) ); ?></option>
<?php foreach ( $post_types as $post_type ) : ?>
<option value="<?php echo esc_attr( add_query_arg( [ $query_var => $post_type->name, $page_var => false ], $base_url ) ) ?>" <?php selected( $post_type->name, wp_unslash( $_GET[ $query_var ] ?? '' ) ); ?>><?php echo esc_html( $post_type->label ); ?></option>
<option value="<?php echo esc_attr( add_query_arg( [ $query_var => $post_type->name, $page_var => false ], $base_url ) ) ?>" <?php selected( $post_type->name, sanitize_key( wp_unslash( $_GET[ $query_var ] ?? '' ) ) ); ?>><?php echo esc_html( $post_type->label ); ?></option>
<?php endforeach; ?>
</select>
</div>
2 changes: 1 addition & 1 deletion src/taxonomy/render.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
<select class="wp-block-query-filter-post-type__select wp-block-query-filter__select" id="<?php echo esc_attr( $id ); ?>" data-wp-on--change="actions.navigate">
<option value="<?php echo esc_attr( $base_url ) ?>"><?php echo esc_html( $attributes['emptyLabel'] ?: __( 'All', 'query-filter' ) ); ?></option>
<?php foreach ( $terms as $term ) : ?>
<option value="<?php echo esc_attr( add_query_arg( [ $query_var => $term->slug, $page_var => false ], $base_url ) ) ?>" <?php selected( $term->slug, wp_unslash( $_GET[ $query_var ] ?? '' ) ); ?>><?php echo esc_html( $term->name ); ?></option>
<option value="<?php echo esc_attr( add_query_arg( [ $query_var => $term->slug, $page_var => false ], $base_url ) ) ?>" <?php selected( $term->slug, sanitize_key( wp_unslash( $_GET[ $query_var ] ?? '' ) ) ); ?>><?php echo esc_html( $term->name ); ?></option>
<?php endforeach; ?>
</select>
</div>