wp-register-notices/phpcs.xml.dist at main · arraypress/wp-register-notices · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
<?xml version="1.0"?>
<ruleset name="WP Register Columns">
    <description>Defect-hunting sniffs. Preferences live in phpcs-format.xml.dist.</description>

    <file>src</file>

    <arg name="extensions" value="php"/>
    <arg name="colors"/>
    <arg value="sp"/>

    <config name="testVersion" value="8.3-"/>
    <config name="installed_paths" value="vendor/wp-coding-standards/wpcs,vendor/phpcompatibility/php-compatibility,vendor/phpcompatibility/phpcompatibility-paragonie,vendor/phpcompatibility/phpcompatibility-wp,vendor/phpcsstandards/phpcsutils,vendor/phpcsstandards/phpcsextra"/>

    <rule ref="PHPCompatibilityWP"/>

    <rule ref="WordPress.Security"/>
    <rule ref="WordPress.DB"/>
    <rule ref="WordPress.WP.I18n"/>

    <rule ref="WordPress.Security.EscapeOutput">
        <!--
            Every one of these echoes the return value of an EDD markup helper:
            EDD()->html->select(), ->product_dropdown(), ->date_field() and the
            rest. They return escaped HTML by design, and escaping the result
            again would print the tags instead of rendering the controls.
            Rendering EDD's own fields is what this library is for, so the
            exclusion is the whole file rather than a line list.
        -->
    </rule>


    <rule ref="WordPress.Security.EscapeOutput">
        <!--
            These echo the return value of a plugin's own display_callback.
            Column content is markup by contract; the whole point of the
            callback is to let a plugin return a link or a badge, and escaping
            it here would print the tags. Escaping is the callback's job, and
            the consuming plugins do it.
        -->
        <exclude-pattern>src/Tables/*</exclude-pattern>
    </rule>

    <!--
        No runtime code interpreter, anywhere that ships. It is a construct
        WordPress security scanners report on sight, and a plugin's vendor
        directory does get scanned: by WordPress.org on submission, and by
        security plugins on the live site. The sniff is only a warning by
        default, and a warning does not fail CI.
    -->
    <rule ref="Squiz.PHP.Eval">
        <type>error</type>
    </rule>

</ruleset>