Automattic/VIP-Coding-Standards
Stars: 204
Forks: 39
Pull Requests: 431
Issues: 366
Watchers: 11
Last Updated: 2023-09-14 09:05:45
PHP_CodeSniffer ruleset to enforce WordPress VIP coding standards.
License: Other
Languages: PHP, JavaScript, Shell, CSS
https://wpvip.com/documentation/how-to-install-php-code-sniffer-for-wordpress-com-vip/
VIP Coding Standards
This project contains PHP_CodeSniffer (PHPCS) sniffs and rulesets to validate code developed for WordPress VIP.
This project contains two rulesets:
WordPressVIPMinimum- for use with projects on the (older) WordPress.com VIP platform.WordPress-VIP-Go- for use with projects on the (newer) VIP Go platform.
These rulesets contain only the rules which are considered to be "errors" and "warnings" according to the WordPress VIP Go documentation.
The rulesets use rules from the WordPress Coding Standards (WPCS) project, as well as the VariableAnalysis standard.
Go to https://docs.wpvip.com/technical-references/code-review/phpcs-report/ to learn about why violations are flagged as errors vs warnings and what the levels mean.
Minimal requirements
Installation
To install the VIP Coding Standards, run:
composer config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
composer require automattic/vipwpcsor if installing globally:
composer g config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
composer g require automattic/vipwpcsThis will install the latest compatible versions of PHPCS, PHPCSUtils, PHPCSExtra, WPCS and VariableAnalysis and register the external standards with PHP_CodeSniffer.
Please refer to the installation instructions for installing PHP_CodeSniffer for WordPress.com VIP for more details.
As of VIPCS version 2.3.0, there is no need to require the PHP_CodeSniffer Standards Composer Installer Plugin anymore as it is now a requirement of VIPCS itself. Permission to run the plugin will still need to be granted though when using Composer 2.2 or higher.
Contribution
Please see CONTRIBUTION.md.
License
Licensed under GPL-2.0-or-later.
OPEN ISSUES
See all- Catch `setup_post_data` call without checking user capabilities in templates by @david-binda
- Report on code attempting to set image quality for VIP Go File service to 100 by @david-binda
- Callback functions for add_menu_page() should enforce credential-checks by @gudmdharalds
- flag esc_* inside <script> tag by @david-binda
- Flag cases when `rawurlencode` should be used over `esc_` functions by @david-binda
- Flag missing `include_children = false` on tax queries by @david-binda
- Flag Not setting a value in cache when a failure happens by @david-binda
- include `url(' . esc_url_raw()` to proper escaping function sniff by @david-binda
- Almost every WP CLI command should call `stop_the_insanity()` by @david-binda
- Add check for queries made without post_status or post_type by @GaryJones
- Project Growth by @GaryJones
- Audit Public Sniff Properties by @GaryJones
- Complete TODO for RestrictedHookSniff to adding proper VIP doc link for error message by @rebeccahum
- Global memcached groups names by @rebeccahum
- Improve dangerouslySetInnerHTML by @rebeccahum
- Flag posts_per_page value of -1 by @rebeccahum
- Improve innerHTML when sanitized with `DOMPurify.sanitize()` by @BrookeDot
- Evaluate WPCS VIP issues by @GaryJones
- Don't flag window.location.href.indexOf() by @GaryJones
- pre_get_posts filter should not be flagged to return value by @rebeccahum
- Catch incorrect bloginfo() usage by @gudmdharalds
- Flag incorrect use of filter (instead of action) before AlwaysReturnSniff by @rogertheriault
- Enhance logic of LowCacheTime to minimize noise. by @mdbitz
- Downgrade "HTML string concatenation detected" rule from an error to a warning by @dartiss
- Improve file operations checks to allow for use of stream wrappers by @GaryJones
- Adding WordPress-VIP-Go ruleset suppresses many warnings by @paulschreiber
- Remove JS/CSS Sniffs by @rebeccahum
- File inclusion - check for constant defined in the current file by @GaryJones
- IncludingFile: Support runtime setting for custom variables in paths. by @GaryJones
- Check files in the vip-config/ directory for WordPress functions by @GaryJones
- New Sniff: wp_get_post_revisions memory issues by @mikeyarce
- Consider wpcom_vip_get_resized_remote_image_url() as auto-escaping if fourth argument is truthy by @GaryJones
- PHPCSUtils: Add dependency by @GaryJones
- WordPressVIPMinimum.Variables.ServerVariables.UserControlledHeaders wrong & incomplete by @kkmuffme
- New Sniff: target="_blank" by @mikeyarce
- Change name of BatcacheWhitelistedParams sniff by @GaryJones
- WPCS 3.0 removes WordPress.PHP.StrictComparisons by @GaryJones
- VIPCS 3.0: Remove WordPressVIPMinimum.Variables.VariableAnalysis by @GaryJones
- Make suggestion when autoload resolves to true by @GaryJones
- WordPressVIPMinimum.Performance.FetchingRemoteData.FileGetContentsRemoteFile incorrect for php://input by @kkmuffme
- Review the WordPressVIPMinimum.Classes.DeclarationCompatibility sniff by @jrfnl
- Review the WordPressVIPMinimum.Classes.RestrictedExtendClasses sniff by @jrfnl
- Review the WordPressVIPMinimum.Compatibility.Zoninator sniff by @jrfnl
- Review the WordPressVIPMinimum.Constants.ConstantString sniff by @jrfnl
- Review the WordPressVIPMinimum.Constants.RestrictedConstants sniff by @jrfnl
- Review the WordPressVIPMinimum.Files.IncludingFile sniff by @jrfnl
- Review the WordPressVIPMinimum.Functions.CheckReturnValue sniff by @jrfnl
- Review the WordPressVIPMinimum.Functions.DynamicCalls sniff by @jrfnl
- Review the WordPressVIPMinimum.Functions.RestrictedFunctions sniff by @jrfnl
- Review the WordPressVIPMinimum.Functions.StripTags sniff by @jrfnl
- Review the WordPressVIPMinimum.Hooks.AlwaysReturnInFilter sniff by @jrfnl
- Review the WordPressVIPMinimum.Hooks.PreGetPosts sniff by @jrfnl
- Review the WordPressVIPMinimum.Hooks.RestrictedHooks sniff by @jrfnl
- Review the WordPressVIPMinimum.JS.HTMLExecutingFunctions sniff by @jrfnl
- Review the WordPressVIPMinimum.JS.InnerHTML sniff by @jrfnl
- Review the WordPressVIPMinimum.JS.StringConcat sniff by @jrfnl
- Review the WordPressVIPMinimum.JS.StrippingTags sniff by @jrfnl
- Review the WordPressVIPMinimum.JS.Window sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.CacheValueOverride sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.FetchingRemoteData sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.LowExpiryCacheTime sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.NoPaging sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.OrderByRand sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.RegexpCompare sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.RemoteRequestTimeout sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.TaxonomyMetaInOptions sniff by @jrfnl
- Review the WordPressVIPMinimum.Performance.WPQueryParams sniff by @jrfnl
- Review the WordPressVIPMinimum.Security.EscapingVoidReturnFunctions sniff by @jrfnl
- Review the WordPressVIPMinimum.Security.ExitAfterRedirect sniff by @jrfnl
- Review the WordPressVIPMinimum.Security.Mustache sniff by @jrfnl
- Review the WordPressVIPMinimum.Security.PHPFilterFunctions sniff by @jrfnl
- Review the WordPressVIPMinimum.Security.ProperEscapingFunction sniff by @jrfnl
- Review the WordPressVIPMinimum.Security.StaticStrreplace sniff by @jrfnl
- Review the WordPressVIPMinimum.Security.Twig sniff by @jrfnl
- Review the WordPressVIPMinimum.Security.Vuejs sniff by @jrfnl
- Review the WordPressVIPMinimum.UserExperience.AdminBarRemoval sniff by @jrfnl
- Review the WordPressVIPMinimum.Variables.RestrictedVariables sniff by @jrfnl
- Review the WordPressVIPMinimum.Variables.ServerVariables sniff by @jrfnl
- Review all sniffs for compatibility with PHPCS >= 4.0 by @jrfnl
- Review use of external sniffs by @jrfnl
- Support when esc_xml() should be used by @GaryJones
- Flag incorrectly constructed mailto links by @GaryJones
- Check the hook callback parameter count ? by @jrfnl
- Review the `AbstractVariableRestrictionsSniff` class by @jrfnl
- Bump VariableAnalysis to ^2.9.0 to allow use of the backported options by @GaryJones
- Account for upcoming change in WP 5.7 / script tag use by @jrfnl
- Inconsistent treatment of translated strings by @GaryJones
- Move post__not_in sniff to use the grouping in new abstract of WPQueryParamsSniff by @rebeccahum
- Remove Undefined Variable Warning when Arguments are Passed to Templates by @kopepasah
- Deprecate WordPressVIPMinimum ruleset by @rebeccahum
- Convert htmlAttrNotByEscHTML to warning or back to error for consistency with other rules by @rebeccahum
- Replace WordPress.PHP.StrictComparisons with Universal.Operators.StrictComparisons by @rebeccahum
- Remove ZoninatorSniff by @rebeccahum
- Remove BatcacheWhitelistedParamsSniff by @rebeccahum
- Add sniff to delete_option() + add_option by @GaryJones
- .append() is not necessarily jQuery by @patrik-csak
- switch_to_blog() - flag for missing subsequent restore_current_blog() by @rebeccahum
- CI: (Re-)enable a test run against PHP 8.1/nightly. by @jrfnl
- CI: add a test run against PHPCS 4.x (when it is closer to being released) by @jrfnl
- CI: add code coverage check by @jrfnl
- ProperEscapingFunction: flag printf() usages for placeholders being escaped incorrectly by @rebeccahum
- Sniff for getimagesize() by @davidsword
- HTMLExecutingFunctionsSniff: Add more unsafe functions to $HTMLExecutingFunctions by @rebeccahum
- Custom IniSet Sniff to allow for certain safelisted options by @rebeccahum
- Identify sniffs related to VIP Go platform compatibility by @rebeccahum
- Disallow deregistering/deqeueing of certain assets that break QM by @rebeccahum
- Improve flush_rewrite_rules warning by @mikeyarce
- Flag if Advanced Custom Fields plugin version is 4.* by @rebeccahum
- Add warning for list_files function and related by @ovidiul
- Sniff for using PDO to connect to DB by @ross-mulcahy
- Add a check for upgrader_process_complete by @terriann
- Add check for register_uninstall_hook by @terriann
RELEASES
See all- 2.3.3 by @rebeccahum
- 2.3.2 by @rebeccahum
- 2.3.1 by @GaryJones
- 2.3.0 by @rebeccahum
- 2.2.0 by @GaryJones
- 2.1.0 by @GaryJones
- 2.0.0 by @GaryJones
- 1.0.0 by @GaryJones
- 0.4.0 by @GaryJones
- 0.3.1 by @gudmdharalds
- 0.2.4 by @gudmdharalds
- 0.2.3 by @gudmdharalds
- 0.2.2 by @gudmdharalds
- 0.2.1 by @gudmdharalds
- 0.2.0 by @david-binda
- 0.1.0 by @david-binda
- 3.0.0 by @GaryJones
- 2.3.4 by @GaryJones