-
-
Notifications
You must be signed in to change notification settings - Fork 522
Security/EscapeOutput: fix false negatives when handling anonymous classes #2559
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security/EscapeOutput: fix false negatives when handling anonymous classes #2559
Conversation
36322b6 to
bf27bc6
Compare
jrfnl
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @rodrigoprimo Thank you for working on this.
Unfortunately, this is not sufficient for attributes as there can be multiple attributes attached to a class:
throw new
#[Attribute1]
#[Attribute2('text', 10]
class( $param ) {};You should be able to find various examples of skipping over attributes if you search for T_ATTRIBUTE (especially in the PHPCS repo).
|
Thanks for the review, @jrfnl. I thought about multiple attributes, but only when declared using the same I pushed a commit adding support for this. As you suggested, I checked the PHPCS code for inspiration on how to skip over attributes. The examples that I find there use a This PR is ready for another review. |
The reason is to avoid the code duplication which is now being introduced.... |
I'm sorry, but it is not clear to me which code duplication you are referring to. Here is how I implemented the code using while ( \T_ATTRIBUTE === $this->tokens[ $next_relevant ]['code'] ) {
if ( isset( $this->tokens[ $next_relevant ]['attribute_closer'] ) === false ) {
return;
}
$next_relevant = $this->phpcsFile->findNext(
$ignore,
( $this->tokens[ $next_relevant ]['attribute_closer'] + 1 ),
null,
true
);
if ( false === $next_relevant ) {
return;
}
}And here is how I would implement it using do {
if ( \T_ATTRIBUTE === $this->tokens[ $next_relevant ]['code'] ) {
if ( isset( $this->tokens[ $next_relevant ]['attribute_closer'] ) === false ) {
return;
}
$next_relevant = $this->phpcsFile->findNext(
$ignore,
( $this->tokens[ $next_relevant ]['attribute_closer'] + 1 ),
null,
true
);
if ( false === $next_relevant ) {
return;
}
continue;
}
break;
} while ( true );What is the code duplication that you are referring to? Or maybe there is a simpler way to implement this solution using |
Line 225-228 is basically duplicated in the new code block. With a |
18278eb to
e0e5059
Compare
|
While in a call with @rodrigoprimo we discussed the |
e0e5059 to
2e2b8ec
Compare
|
Thanks for your help during the call, @jrfnl. The commit you added looks good to me as is. I just added another commit as we discussed including a new test that will make the condition in the |
jrfnl
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @rodrigoprimo ! This looks good to me.
Notes for other reviewers:
- The actual code change will be easier to review while ignoring whitespace changes.
- Please SQUASH-MERGE this PR!
|
@rodrigoprimo Would you mind rebasing this PR to solve the conflicts ? @dingo-d Got a chance to review this PR ? If you approve, please squash-merge. |
…asses This commit fixes false negatives when the sniff handles readonly anonymous classes and anonymous classes with attributes that are part of a throw statement. When stepping over tokens after `T_THROW` to find the `T_OPEN_PARENTHESIS` of the exception creation function call/class instantiation, the sniff was not considering that it might need to step over `T_READONLY` tokens or attribute declarations when dealing with anonymous classes. Fixes 2552
fe635c1 to
d64cb94
Compare
Sure, I rebased this PR and solved the conflicts. |
…asses (WordPress#2559) * Security/EscapeOutput: fix false negatives when handling anonymous classes This commit fixes false negatives when the sniff handles readonly anonymous classes and anonymous classes with attributes that are part of a throw statement. When stepping over tokens after `T_THROW` to find the `T_OPEN_PARENTHESIS` of the exception creation function call/class instantiation, the sniff was not considering that it might need to step over `T_READONLY` tokens or attribute declarations when dealing with anonymous classes. Fixes WordPress#2552 --------- Co-authored-by: jrfnl <[email protected]>
This PR fixes false negatives when the sniff
WordPress.Security.EscapeOutputhandles readonly anonymous classes and anonymous classes with attributes that are part of a throw statement.When stepping over tokens after
T_THROWto find theT_OPEN_PARENTHESISof the exception creation function call/class instantiation, the sniff was not considering that it might need to step overT_READONLYtokens or attribute declarations when dealing with anonymous classes.Fixes #2552