Skip to content

Commit f9c4005

Browse files
committed
Ensure sniff handles custom nonce verification functions case correctly
1 parent 61bbbd1 commit f9c4005

File tree

2 files changed

+10
-0
lines changed

2 files changed

+10
-0
lines changed

WordPress/Sniffs/Security/NonceVerificationSniff.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,8 @@ private function set_cache( $filename, $start, $end, $nonce ) {
413413
*/
414414
protected function mergeFunctionLists() {
415415
if ( $this->customNonceVerificationFunctions !== $this->addedCustomNonceFunctions ) {
416+
$this->customNonceVerificationFunctions = array_map( 'strtolower', $this->customNonceVerificationFunctions );
417+
416418
$this->nonceVerificationFunctions = RulesetPropertyHelper::merge_custom_array(
417419
$this->customNonceVerificationFunctions,
418420
$this->nonceVerificationFunctions

WordPress/Tests/Security/NonceVerificationUnitTest.1.inc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -493,3 +493,11 @@ function ajax_process() {
493493

494494
update_post_meta( (int) $_POST['id'], 'a_key', $_POST['a_value'] );
495495
}
496+
497+
// phpcs:set WordPress.Security.NonceVerification customNonceVerificationFunctions[] MIXED_case_NAME
498+
function non_ascii_characters() {
499+
MIXED_case_NAME( $_POST['something'] ); // Passing $_POST to ensure the sniff bails correctly for variables inside the nonce verification function.
500+
501+
update_post_meta( (int) $_POST['id'], 'a_key', $_POST['a_value'] );
502+
}
503+
// phpcs:set WordPress.Security.NonceVerification customNonceVerificationFunctions[]

0 commit comments

Comments
 (0)