You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When outputting a numeric value as an integer, the absint() and intval() functions are treated as safe for output by WPCS. The same is not true for ceil(), floor(), and round().
Describe the solution you'd like
The ceil(), floor(), and round() functions should be added to the Sniff:$escapingFunctions property.
The text was updated successfully, but these errors were encountered:
Would make sense to actually extend it to all functions that return int or float, since that is always safe for output
EDIT:
Since the PR #2082 got stuck due to missing maintainer feedback after initial review, I closed it.
I just added it to my XML now with a couple additional functions.
Here's how I did it, by just grep-ing the native types from psalm:
grep -Poh '(?<=^'\'')\w+(?='\'' => \['\''(?>\??(?>(?>positive-)?int(?><(?>min|-?\d+), ?(?>max|-?\d+)>)?|float|\d+|numeric(?>-string)?|bool|false|true|null)\|)*(?>\??(?>(?>positive-)?int(?><(?>min|-?\d+), ?(?>max|-?\d+)>)?|float|\d+|numeric(?>-string)?)[|'\''])+(?>\??(?>(?>positive-)?int(?><(?>min|-?\d+), ?(?>max|-?\d+)>)?|float|\d+|numeric(?>-string)?|bool|false|true|null)[|'\''])*[,\]])' vendor/vimeo/psalm/dictionaries/CallMap.php | grep -vE '^(echo|v?f?printf?|trigger_error|exit|die|ps_\w+)$' | sed 's/^/<element value="/' | sed 's#$#"/>#'
functions (excluding all methods) that return:
int
positive-int
int<-100, -20>
int<min, max>
float
literal ints like 0|5
numeric
numeric-string
?int (nullable of any of the above)
and their union return type may additionally contain any of
bool
false
true
null
If you want to get only functions that have at least 1 parameter, change [,\]] at the end to ,
e.g. in case you want to separate customAutoEscaped and customEscapingFunctions
Additionally all printing and exit functions are excluded
Elements are formatted so you can just copy and paste it to your .xml in customEscapingFunctions (since there's no difference between those and autoescaped functions anyway, see #2411)
Is your feature request related to a problem?
When outputting a numeric value as an integer, the
absint()
andintval()
functions are treated as safe for output by WPCS. The same is not true forceil()
,floor()
, andround()
.Describe the solution you'd like
The
ceil()
,floor()
, andround()
functions should be added to theSniff:$escapingFunctions
property.The text was updated successfully, but these errors were encountered: