ProperEscapingFunction: improve "action" match precision #670
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 tasks
In VIPCS 2.2.0, checking for the use of `esc_url()` for "action" HTML attributes was introduced in PR 575 in response to issue 554. As it is not inconceivable that "action" is used as a suffix for custom HTML attributes - like "data-action"- for which the value does not necessarily has to be a URL, the check for the "action" HTML attribute should make sure it is the complete attribute name and not used as a suffix for a custom attribute name. This change contains a minor refactor of the code which examines the content of the previous text string. Instead of looping over the various lists and doing a `substr()` on the same content 25 times, it will now use a regular expression to gather the necessary information to throw the right errors in one go. Includes unit tests. Fixes 669 Note: This PR removes two `private` properties which were introduced in 624/VIPCS 2.3.0 and two `public` methods. The removal of the properties is safe. The removal of the `public` methods could be considered a BC-break as these methods were `public`, though they never should have been. If so preferred, the `public` methods could be deprecated instead and remain in the code base as dead code/emptied out methods until the next major release upon which they could be removed.
This adds test cases with: * No space before "action" as it is at the start of the line in a multi-line text string. * A tab before "action". ... and makes minor adjustments to the regex to safeguard handling these cases correctly.
jrfnl
force-pushed
the
fix/669-properescaping-attribute-matching-precision
branch
from
2f537c0 to
1401543
Compare
rebeccahum
previously approved these changes
Apr 22, 2021
... the `public` methods and as those use the `private` properties and extending sniffs may rely on the functionality of the `public` methods, we can't removed the `private` properties yet either, so deprecating those too.
rebeccahum
approved these changes
Apr 22, 2021
rebeccahum
deleted the
fix/669-properescaping-attribute-matching-precision
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In VIPCS 2.2.0, checking for the use of
esc_url()for "action" HTML attributes was introduced in PR #575 in response to issue #554.As it is not inconceivable that "action" is used as a suffix for custom HTML attributes - like "data-action"- for which the value does not necessarily has to be a URL, the check for the "action" HTML attribute should make sure it is the complete attribute name and not used as a suffix for a custom attribute name.
This change contains a minor refactor of the code which examines the content of the previous text string.
Instead of looping over the various lists and doing a
substr()on the same content 25 times, it will now use a regular expression to gather the necessary information to throw the right errors in one go.Includes unit tests.
Fixes #669
Note: This PR removes two
privateproperties which were introduced in 624/VIPCS 2.3.0 and twopublicmethods.The removal of the properties is safe. The removal of the
publicmethods could be considered a BC-break as these methods werepublic, though they never should have been.If so preferred, the
publicmethods could be deprecated instead and remain in the code base as dead code/emptied out methods until the next major release upon which they could be removed.New commits since pulling
ProperEscapingFunction: fine-tune attribute regex
This adds test cases with:
... and makes minor adjustments to the regex to safeguard handling these cases correctly.
ProperEscapingFunction: deprecate, don't remove
... the
publicmethods and as those use theprivateproperties and extending sniffs may rely on the functionality of thepublicmethods, we can't removed theprivateproperties yet either, so deprecating those too.