mirror of
https://github.com/WordPress/WordPress-Coding-Standards.git
synced 2026-07-27 10:37:02 +08:00
80faf1d4d1
This sniff is based on a sniff previously pulled to the TRT fork of WPCS as `Theme.DeprecatedConstants`.
Related issue: WPTRT/WordPress-Coding-Standards/issues/ 23
Original PR: WPTRT/WordPress-Coding-Standards/pull/ 30
Covers the list of constants found in: Otto42/theme-check/pull/ 162
Differences between that sniff and this one:
* This sniff is a **_lot_** more comprehensive in preventing false positives.
The original sniff was one of the first ones I wrote and it's kind of sweet to look back at that code which I wrote over a year ago and see how much I've learned about writing sniffs in the mean time.
* The original sniff was called `Theme.DeprecatedConstants`, but in reality, most of these constants aren't officially deprecated, though their usage is discouraged and the constants being addressed are not 100% related to themes either. With that in mind, I've renamed the sniff to `WP.DiscouragedConstants` and changed the error level from Error to Warning.
Also see: https://core.trac.wordpress.org/ticket/18298
* This version of the sniff also addresses the concerns raised in WPTRT/WordPress-Coding-Standards/issues/ 110 about themes `define`-ing any of these constants and leverages the `AbstractFunctionParameterSniff` to do so.
Includes quite extensive unit tests. More are definitely welcome, especially to prevent false positives.
I've added the sniff to the `WordPress-Extra` ruleset.
Based on https://vip.wordpress.com/documentation/code-review-what-we-look-for/#using-theme-constants and https://core.trac.wordpress.org/ticket/18298#comment:2, I've also added the sniff to the `WordPress-VIP` ruleset. /cc @sboisvert @david-binda @ntwb
Fixes 97
Will also fix WPTRT/WordPress-Coding-Standards/issues/ 110 once the original sniff gets removed from the TRT fork and this sniff is added to the TRT ruleset instead.
95 lines
5.3 KiB
XML
95 lines
5.3 KiB
XML
<?xml version="1.0"?>
|
|
<ruleset name="WordPress VIP">
|
|
<description>WordPress VIP Coding Standards</description>
|
|
|
|
<autoload>./../WordPress/PHPCSAliases.php</autoload>
|
|
|
|
<rule ref="WordPress-Core"/>
|
|
|
|
<!-- Covers:
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#removing-the-admin-bar
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#cron-schedules-less-than-15-minutes-or-expensive-events
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#direct-database-queries
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#filesystem-writes
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#order-by-rand
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#using-__file__-for-page-registration
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#uncached-functions
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#flush_rewrite_rules
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#session_start-and-other-session-related-functions
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#functions-that-use-joins-taxonomy-relation-queries-cat-tax-queries-subselects-or-api-calls
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#querying-on-meta_value
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#manipulating-the-timezone-server-side
|
|
https://vip.wordpress.com/documentation/code-review-what-we-look-for/#validation-sanitization-and-escaping
|
|
-->
|
|
<rule ref="WordPress.VIP"/>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/code-review-what-we-look-for/#validation-sanitization-and-escaping -->
|
|
<!-- https://vip.wordpress.com/documentation/best-practices/security/validating-sanitizing-escaping/ -->
|
|
<rule ref="WordPress.XSS.EscapeOutput"/>
|
|
<rule ref="WordPress.CSRF.NonceVerification"/>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/code-review-what-we-look-for/#using-instead-of -->
|
|
<rule ref="WordPress.PHP.StrictComparisons"/>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/best-practices/database-queries/ -->
|
|
<rule ref="WordPress.WP.PreparedSQL"/>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/code-review-what-we-look-for/#commented-out-code-debug-code-or-output -->
|
|
<rule ref="Squiz.PHP.CommentedOutCode">
|
|
<properties>
|
|
<property name="maxPercentage" value="45"/>
|
|
</properties>
|
|
</rule>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#eval-and-create_function -->
|
|
<rule ref="Squiz.PHP.Eval"/>
|
|
<rule ref="Squiz.PHP.Eval.Discouraged">
|
|
<type>error</type>
|
|
<message>eval() is a security risk so not allowed.</message>
|
|
</rule>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#eval-and-create_function -->
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#serializing-data -->
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#encoding-values-used-when-creating-a-url-or-passed-to-add_query_arg -->
|
|
<!-- https://github.com/Automattic/vip-scanner/blob/master/vip-scanner/checks/ForbiddenPHPFunctionsCheck.php -->
|
|
<rule ref="WordPress.PHP.DiscouragedPHPFunctions">
|
|
<!-- https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/633#issuecomment-266634811 -->
|
|
<properties>
|
|
<property name="exclude" value="obfuscation"/>
|
|
</properties>
|
|
</rule>
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#settings-alteration -->
|
|
<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration">
|
|
<type>error</type>
|
|
</rule>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/code-review-what-we-look-for/#commented-out-code-debug-code-or-output -->
|
|
<rule ref="WordPress.PHP.DevelopmentFunctions"/>
|
|
<rule ref="WordPress.PHP.DevelopmentFunctions.error_log">
|
|
<type>error</type>
|
|
</rule>
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#settings-alteration -->
|
|
<rule ref="WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure">
|
|
<type>error</type>
|
|
</rule>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/code-review-what-we-look-for/#using-in_array-without-strict-parameter -->
|
|
<rule ref="WordPress.PHP.StrictInArray"/>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#use-wp_parse_url-instead-of-parse_url -->
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#use-wp_json_encode-over-json_encode -->
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#filesystem-writes -->
|
|
<!-- https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#remote-calls -->
|
|
<rule ref="WordPress.WP.AlternativeFunctions"/>
|
|
<!-- VIP recommends other functions -->
|
|
<rule ref="WordPress.WP.AlternativeFunctions.curl">
|
|
<message>Using cURL functions is highly discouraged within VIP context. Check (Fetching Remote Data) on VIP Documentation.</message>
|
|
</rule>
|
|
<rule ref="WordPress.WP.AlternativeFunctions.file_get_contents">
|
|
<message>%s() is highly discouraged, please use vip_safe_wp_remote_get() instead.</message>
|
|
</rule>
|
|
|
|
<!-- https://vip.wordpress.com/documentation/code-review-what-we-look-for/#using-theme-constants -->
|
|
<rule ref="WordPress.WP.DiscouragedConstants"/>
|
|
|
|
</ruleset>
|
