Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WordPress.Security.NonceVerification.NoNonceVerification: Remove outdated reference from WordPress-VIP-Go ruleset and let inheritance from parent #607

Merged
merged 2 commits into from
Jan 13, 2021

Conversation

rebeccahum
Copy link
Contributor

Fixes #605.

…ated reference from WordPress-VIP-Go ruleset and let inheritance from parent
@rebeccahum rebeccahum requested a review from a team as a code owner January 8, 2021 13:44
Copy link
Contributor

@GaryJones GaryJones left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved - in this case, NoNonceVerification hasn't existed in WPCS since 2.0.0, and we've required WPCS 2.1.0 as a dev dependency since VIPCS 2.0, so all good.

@rebeccahum rebeccahum merged commit 0fb90dc into develop Jan 13, 2021
@rebeccahum rebeccahum deleted the rebecca/cleanup_605 branch January 13, 2021 15:32
@jrfnl
Copy link
Collaborator

jrfnl commented Mar 3, 2021

Reviewed after the fact.

Notes:

This commit constitutes a functional change, though in reality that change took effect once WPCS 2.0 was required via Composer.

Previously there was only one error code in WPCS from the NonceVerification sniff - NoNonceVerification -. This same error code would throw a warning or an error depending on whether or not a superglobal was referenced. Both would have severity 5.

The ruleset change in VIP Go effectively, turned all notices from the NonceVerification sniff into warnings with severity 10.

Once WPCS 2.0 was required, the ruleset change in VIP Go no longer had any effect and the sniff would now throw the Missing error and the Recommended warning at severity 5.

This update formalizes the current status-quo by removing the reference from the VIP Go ruleset.
The "old" situation of turning violations from the NonceVerification sniff into warnings with severity 10 is effectively abandoned by this change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Remove reference WordPress.Security.NonceVerification.NoNonceVerification
3 participants