Skip to content

VIP Coding Standards 3.1.0

Latest
Latest

Choose a tag to compare

View all tags
@GaryJones GaryJones released this 27 Jul 14:38
· 9 commits to develop since this release
3.1.0
This tag was signed with the committer’s verified signature.
GaryJones Gary Jones
GPG key ID: 26945F7AF685BCCB
Verified
Learn about vigilant mode.
9c47cd0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release raises the minimum requirements and reworks a large number of the VIPCS sniffs.

The minimum WordPressCS requirement is raised to 3.4.1 (from 3.2.0) — a security release which also brings numerous accuracy improvements to sniffs that VIPCS bundles — along with PHP_CodeSniffer 3.13.5, PHPCSUtils 1.2.3, PHPCSExtra 1.5.1 and VariableAnalysis 2.13.0. The minimum PHP version is now 7.4. Many sniffs have been reworked to fix false positives, add support for modern PHP syntaxes and adopt PHPCSUtils. The JavaScript-specific sniffs and the DynamicCalls sniff have been hard-deprecated ahead of their removal in 4.0.0, and the unused Security.Twig sniff has been removed.

Please ensure you run composer update automattic/vipwpcs --with-dependencies to benefit from this.

Added

  • #882: Performance/NoPaging: flag posts_per_page and numberposts set to -1 (WordPress' "no limit" value), which previously slipped past the WPCS > 100 check.
  • #883: Hooks/AlwaysReturnInFilter: exit, die or throw in a filter callback now raises a dedicated TerminatingInsteadOfReturn warning, instead of the generic MissingReturnStatement error.
  • #890: Add a Byte Order Mark (BOM) check to the WordPressVIPMinimum ruleset.

Changed

  • #824: Disable WordPress.Security.EscapeOutput.ExceptionNotEscaped in the WordPressVIPMinimum ruleset, as throwing an exception with a translated message triggered it and the check is considered controversial.
  • #854: Functions/StripTags: always flag use of strip_tags(), as the function should never be used on the VIP platform.
  • As VIPCS bundles a number of WordPressCS sniffs and the minimum WordPressCS version has been raised to 3.4.1, users will now receive more accurate results from the following WPCS sniffs (see the WordPressCS 3.3.0, 3.4.0 and 3.4.1 release notes for full details):
    • WordPress.DB.DirectDatabaseQuery: recognises more caching functions (such as the wp_cache_*_multiple() and wp_cache_*_salted() functions), and has fewer false positives when caching functions are called using a non-canonical function name.
    • WordPress.DB.PreparedSQL: fewer false positives for correctly escaped SQL called using a non-canonical function name, and for static method calls to a non-global class named wpdb.
    • WordPress.Security.EscapeOutput: adds support for attributes on anonymous classes (PHP 8.0), readonly anonymous classes (PHP 8.3) and exit as a function call (PHP 8.4); expands *::class false-positive protection; fixes false positives/negatives for get_search_query() and _deprecated_file() used with non-standard casing; and no longer treats wp_kses_allowed_html() as an escaping function, which may surface a new warning where that function's return value was being output directly.
    • WordPress.Security.NonceVerification: fewer false positives when the nonce-checking function is called using a non-canonical function name.
    • WordPress.Security.ValidatedSanitizedInput: clearer error message for the InputNotValidated error code.
    • WordPress.WP.AlternativeFunctions: fixes a false negative when class members share a name with select global WP functions/constants, and a false positive for the fully qualified stream constants \STDIN, \STDOUT and \STDERR.
    • WordPress.WP.CronInterval: fixes a false positive when the callback reference used a different case to the function declaration.

Deprecated

  • #839: Hard-deprecate all JavaScript-specific sniffs (WordPressVIPMinimum.JS.*). They are excluded from the rulesets and will be removed in VIPCS 4.0.0.
  • #865: Hard-deprecate the WordPressVIPMinimum.Functions.DynamicCalls sniff. It is excluded from the rulesets and will be removed in VIPCS 4.0.0.

Removed

  • #864: Remove the unused WordPressVIPMinimum.Security.Twig sniff.

Fixed

  • #840: Fix dangerous comparisons against the value of token constants.
  • #842: Security/Mustache: fix potential false positives on a delimiter change, and examine double-quoted strings with interpolation and nowdocs which were previously skipped.
  • #846, #848: Security/PHPFilterFunctions: fix false positives for method calls, namespaced function calls and attributes which share the function name.
  • #847: Security/StaticStrreplace: fix flawed detection of str_replace() by extending the WordPressCS AbstractFunctionParameterSniff; method calls, namespaced calls, first-class callables and argument unpacking are no longer flagged.
  • #850: Variables/ServerVariables: fix incorrect quote stripping and expand safeguards against false positives.
  • #851: Constants/ConstantString: fix flawed detection of define()/defined() by extending AbstractFunctionParameterSniff, and clarify the error message.
  • #852: Hooks/RestrictedHooks: fix false positives (method/namespaced calls, first-class callables, attributes) and disregard comments in the hook-name parameter.
  • #853: Performance/LowExpiryCacheTime: avoid a possible fatal error when a PHP 7.4+ numeric literal or 8.1+ octal literal is used as the cache time.
  • #855: Performance/FetchingRemoteData: fix flawed function-call detection by extending AbstractFunctionParameterSniff.
  • #858: Classes/DeclarationCompatibility: modernise and fix the sniff.
  • #861: Security/EscapingVoidReturnFunctions: fix flawed detection of esc_*()/wp_kses*() calls by extending AbstractFunctionParameterSniff; safeguard argument unpacking, attributes and first-class callables.
  • #862: Functions/DynamicCalls: fix end-of-statement determination and other minor issues.
  • #866: UserExperience/AdminBarRemoval: several fixes — case-insensitive function-name matching, recognise add_action() as an alias, disregard comments in parameters, and no longer treat a CSS file as PHP; plus PHP 8.0+ function-call and 8.1+ first-class-callable support.
  • #867: Performance/CacheValueOverride: fix false negatives for fully qualified calls and false positives for PHP 8.1+ first-class callables and variables.
  • #869: Constants/RestrictedConstants: fix a nonsensical comparison and use PHPCSUtils for quote stripping.
  • #872: Performance/TaxonomyMetaInOptions: extend AbstractFunctionParameterSniff and add PHP 8.0+ function-call and nullsafe-operator support.
  • #881: Hooks/AlwaysReturnInFilter: resolve bugs and adopt PHPCSUtils.

Security

  • WordPressCS 3.4.1 fixes a vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff whereby running it over untrusted code could lead to arbitrary command execution on the scanning host. The VIPCS rulesets do not enable that sniff, so VIPCS' own behaviour is unaffected, but raising the minimum WordPressCS version removes the affected releases from the dependency tree and protects users who additionally run the WordPress or WordPress-Extra standards.

Maintenance

  • Composer:
    • #857: Raise the minimum supported versions of all coding-standard dependencies. This release requires WordPressCS 3.4.1, PHP_CodeSniffer 3.13.5, PHPCSUtils 1.2.3, PHPCSExtra 1.5.1 and VariableAnalysis 2.13.0.
    • #828: Prevent a composer.lock file from being created.
    • #837: Bump the PHP Parallel Lint requirement.
  • #880: Bump the minimum PHP version to 7.4, drop PHPUnit 8 support and fix CI.
  • Rulesets:
    • #835: Update the schema URL.
    • #860: Fix unescaped special characters in the include/exclude patterns.
  • Sniffs:
    • #843: Fix license information and standardise the file docblocks.
    • #844: Remove @since tags which relate to WordPressCS.
    • #856: Classes/RestrictedExtendClasses: only listen for the extends keyword, significantly improving performance, and add tests.
    • #863: Functions/RestrictedFunctions: improve the is_targetted_token() method.
    • #868: Security/Underscorejs: start using the PHPCSUtils FilePath utility.
    • #870: Various minor CS fixes.
  • Docs:
    • #826: Improve consistency and specificity.
    • #871: Various minor fixes.
    • #875: Performance/WPQueryParams: update a documentation link.
    • Update the minimum requirements in the README.
  • QA:
    • #825: Fix the PHPStan build.
    • #834: Silence a deprecation notice during the CS run.
    • #845: Fix the PHPCompatibility exclusions in the internal ruleset.
    • Align the PHPCompatibility testVersion with the PHP 7.4 minimum requirement.
  • Tests:
    • #833: Fix RulesetTest.
    • #838: Remove a PHPCS version toggle from AlwaysReturnInFilterUnitTest.
    • #890: Refactor the tests and test runner, and preserve/handle a BOM in the ruleset-test fixtures.
  • GitHub Actions:
    • #827: Always quote variables.
    • #829: Run against PHP 8.4.
    • #830: Use the xmllint-validate action runner and add extra checks.
    • #884, #887: Pin third-party GitHub Actions to commit SHAs.
    • #877, #879, #885, #888, #889: Dependency updates via Dependabot.

Full Changelog: 3.0.1...3.1.0

Assets 2
Loading