Skip to content

Commit 72de60d

Browse files
ernilambarernilambar
authored
Merge pull request #995 from WordPress/966-ruleset-for-plugins-to-reference
Improve ruleset files
2 parents e0432ac + 22a5259 commit 72de60d

File tree

4 files changed

+156
-143
lines changed

4 files changed

+156
-143
lines changed

‎.github/workflows/behat-test.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ on:
1313
- 'behat.yml'
1414
- 'composer.json'
1515
- 'composer.lock'
16+
- 'phpcs-rulesets/*.xml'
1617
pull_request:
1718
branches:
1819
- trunk
@@ -26,6 +27,7 @@ on:
2627
- 'behat.yml'
2728
- 'composer.json'
2829
- 'composer.lock'
30+
- 'phpcs-rulesets/*.xml'
2931
types:
3032
- opened
3133
- reopened

‎.github/workflows/php-test.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ on:
1212
- '.wp-env.json'
1313
- '**/package.json'
1414
- 'package-lock.json'
15+
- 'phpcs-rulesets/*.xml'
1516
- 'phpunit.xml.dist'
1617
- 'composer.json'
1718
- 'composer.lock'
@@ -27,6 +28,7 @@ on:
2728
- '.wp-env.json'
2829
- '**/package.json'
2930
- 'package-lock.json'
31+
- 'phpcs-rulesets/*.xml'
3032
- 'phpunit.xml.dist'
3133
- 'composer.json'
3234
- 'composer.lock'

‎phpcs-rulesets/plugin-check.ruleset.xml

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
<?xml version="1.0"?>
2+
<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="WPPluginCheck" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/squizlabs/PHP_CodeSniffer/master/phpcs.xsd">
3+
4+
<!-- For more information: https://make.wordpress.org/plugins/handbook/review/ -->
5+
<description>Standards any plugin to be published on wordpress.org should comply with.</description>
6+
7+
<!-- All SQL queries should be prepared as close to the time of querying the database as possible. -->
8+
<rule ref="WordPress.DB.PreparedSQL"/>
9+
<rule ref="WordPress.DB.PreparedSQL.InterpolatedNotPrepared">
10+
<!-- Ideally this wouldn't trigger on "safe" items, but it's triggered on any variable in the SQL. -->
11+
<type>warning</type>
12+
</rule>
13+
14+
<!-- Verify that placeholders in prepared queries are used correctly. -->
15+
<rule ref="WordPress.DB.PreparedSQLPlaceholders"/>
16+
17+
<!-- Nonces. These are triggered on any GET/POST access items. -->
18+
<rule ref="WordPress.Security.NonceVerification">
19+
<!-- This is triggered on all GET/POST access, it can't be an error. -->
20+
<type>warning</type>
21+
</rule>
22+
23+
<!-- Sanitized Input rules -->
24+
<rule ref="WordPress.Security.ValidatedSanitizedInput">
25+
<type>warning</type>
26+
</rule>
27+
28+
<!-- Prohibit the use of the backtick operator. -->
29+
<rule ref="Generic.PHP.BacktickOperator">
30+
<severity>7</severity>
31+
</rule>
32+
33+
<!-- Prohibit the use of HEREDOC or NOWDOC. -->
34+
<rule ref="Squiz.PHP.Heredoc">
35+
<severity>7</severity>
36+
</rule>
37+
38+
<!-- Prohibit the use of the `goto` PHP language construct. -->
39+
<rule ref="Generic.PHP.DiscourageGoto.Found">
40+
<type>error</type>
41+
<severity>7</severity>
42+
<message>The "goto" language construct should not be used.</message>
43+
</rule>
44+
45+
<!-- Check for error logs in plugin -->
46+
<rule ref="WordPress.PHP.DevelopmentFunctions">
47+
<type>warning</type>
48+
</rule>
49+
50+
<!-- No PHP short open tags allowed. -->
51+
<rule ref="Generic.PHP.DisallowShortOpenTag"/>
52+
<rule ref="Generic.PHP.DisallowShortOpenTag.Found">
53+
<severity>7</severity>
54+
</rule>
55+
<rule ref="Generic.PHP.DisallowShortOpenTag.EchoFound">
56+
<severity>7</severity>
57+
</rule>
58+
59+
<!-- Alternative PHP open tags not allowed. -->
60+
<rule ref="Generic.PHP.DisallowAlternativePHPTags">
61+
<severity>7</severity>
62+
</rule>
63+
64+
<!-- Prevent path disclosure when using add_theme_page(). -->
65+
<rule ref="WordPress.Security.PluginMenuSlug">
66+
<severity>6</severity>
67+
</rule>
68+
69+
<!-- While most plugins shouldn't query the database directly, if they do, it should be done correctly. -->
70+
<!-- Don't use the PHP database functions and classes, use the WP abstraction layer instead. -->
71+
<rule ref="WordPress.DB.RestrictedClasses">
72+
<severity>7</severity>
73+
</rule>
74+
75+
<rule ref="WordPress.DB.RestrictedFunctions">
76+
<severity>7</severity>
77+
</rule>
78+
79+
<!-- Check for code WP does better -->
80+
<rule ref="WordPress.WP.AlternativeFunctions">
81+
<type>error</type>
82+
<exclude name="WordPress.WP.AlternativeFunctions.json_encode_json_encode"/>
83+
<exclude name="WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents"/>
84+
<exclude name="WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents"/>
85+
</rule>
86+
87+
<rule ref="Generic.PHP.ForbiddenFunctions">
88+
<properties>
89+
<property name="forbiddenFunctions" type="array">
90+
<element key="move_uploaded_file" value="null"/>
91+
<element key="passthru" value="null"/>
92+
<element key="proc_open" value="null"/>
93+
<element key="create_function" value="null"/>
94+
<element key="eval" value="null"/>
95+
<element key="str_rot13" value="null"/>
96+
</property>
97+
</properties>
98+
<type>error</type>
99+
<severity>7</severity>
100+
</rule>
101+
102+
<rule ref="Squiz.PHP.DiscouragedFunctions">
103+
<properties>
104+
<property name="forbiddenFunctions" type="array">
105+
<element key="set_time_limit" value="null"/>
106+
<element key="ini_set" value="null"/>
107+
<element key="ini_alter" value="null"/>
108+
<element key="dl" value="null"/>
109+
</property>
110+
</properties>
111+
</rule>
112+
113+
<!-- Check for use of deprecated WordPress classes, functions and function parameters. -->
114+
<rule ref="WordPress.WP.DeprecatedClasses"/>
115+
<rule ref="WordPress.WP.DeprecatedFunctions"/>
116+
<rule ref="WordPress.WP.DeprecatedParameters"/>
117+
<rule ref="WordPress.DateTime.RestrictedFunctions"/>
118+
119+
<!-- Check for deprecated WordPress constants. -->
120+
<rule ref="WordPress.WP.DiscouragedConstants">
121+
<type>error</type>
122+
<severity>7</severity>
123+
</rule>
124+
125+
<!-- Check for discouraged WordPress functions. -->
126+
<rule ref="WordPress.WP.DiscouragedFunctions">
127+
<severity>6</severity>
128+
</rule>
129+
130+
<!-- Check for usage of deprecated parameter values in WP functions and provide alternative based on the parameter passed. -->
131+
<rule ref="WordPress.WP.DeprecatedParameterValues">
132+
<severity>7</severity>
133+
</rule>
134+
135+
<!-- No ByteOrderMark allowed - important to prevent issues with content being sent before headers. -->
136+
<rule ref="Generic.Files.ByteOrderMark">
137+
<severity>7</severity>
138+
</rule>
139+
140+
<!-- Check for missing required function parameters. -->
141+
<rule ref="PluginCheck.CodeAnalysis.RequiredFunctionParameters">
142+
<severity>7</severity>
143+
</rule>
144+
145+
<!-- Check for discouraged load_plugin_textdomain() call. -->
146+
<rule ref="PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound">
147+
<type>error</type>
148+
<severity>7</severity>
149+
</rule>
150+
151+
</ruleset>

‎phpcs-rulesets/plugin-review.xml

Lines changed: 1 addition & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -30,148 +30,6 @@
3030
<exclude-pattern>*/composer_directory/*</exclude-pattern>
3131
<exclude-pattern>*/node_modules/*</exclude-pattern>
3232

33-
<!-- All SQL queries should be prepared as close to the time of querying the database as possible. -->
34-
<rule ref="WordPress.DB.PreparedSQL"/>
35-
<rule ref="WordPress.DB.PreparedSQL.InterpolatedNotPrepared">
36-
<!-- Ideally this wouldn't trigger on "safe" items, but it's triggered on any variable in the SQL. -->
37-
<type>warning</type>
38-
</rule>
39-
40-
<!-- Verify that placeholders in prepared queries are used correctly. -->
41-
<rule ref="WordPress.DB.PreparedSQLPlaceholders"/>
42-
43-
<!-- Nonces. These are triggered on any GET/POST access items. -->
44-
<rule ref="WordPress.Security.NonceVerification">
45-
<!-- This is triggered on all GET/POST access, it can't be an error. -->
46-
<type>warning</type>
47-
</rule>
48-
49-
<!-- Sanitized Input rules -->
50-
<rule ref="WordPress.Security.ValidatedSanitizedInput">
51-
<type>warning</type>
52-
</rule>
53-
54-
<!-- Prohibit the use of the backtick operator. -->
55-
<rule ref="Generic.PHP.BacktickOperator">
56-
<severity>7</severity>
57-
</rule>
58-
59-
<!-- Prohibit the use of HEREDOC or NOWDOC. -->
60-
<rule ref="Squiz.PHP.Heredoc">
61-
<severity>7</severity>
62-
</rule>
63-
64-
<!-- Prohibit the use of the `goto` PHP language construct. -->
65-
<rule ref="Generic.PHP.DiscourageGoto.Found">
66-
<type>error</type>
67-
<severity>7</severity>
68-
<message>The "goto" language construct should not be used.</message>
69-
</rule>
70-
71-
<!-- Check for error logs in plugin -->
72-
<rule ref="WordPress.PHP.DevelopmentFunctions">
73-
<type>warning</type>
74-
</rule>
75-
76-
<!-- No PHP short open tags allowed. -->
77-
<rule ref="Generic.PHP.DisallowShortOpenTag"/>
78-
<rule ref="Generic.PHP.DisallowShortOpenTag.Found">
79-
<severity>7</severity>
80-
</rule>
81-
<rule ref="Generic.PHP.DisallowShortOpenTag.EchoFound">
82-
<severity>7</severity>
83-
</rule>
84-
85-
<!-- Alternative PHP open tags not allowed. -->
86-
<rule ref="Generic.PHP.DisallowAlternativePHPTags">
87-
<severity>7</severity>
88-
</rule>
89-
90-
<!-- Prevent path disclosure when using add_theme_page(). -->
91-
<rule ref="WordPress.Security.PluginMenuSlug">
92-
<severity>6</severity>
93-
</rule>
94-
95-
<!-- While most plugins shouldn't query the database directly, if they do, it should be done correctly. -->
96-
<!-- Don't use the PHP database functions and classes, use the WP abstraction layer instead. -->
97-
<rule ref="WordPress.DB.RestrictedClasses">
98-
<severity>7</severity>
99-
</rule>
100-
101-
<rule ref="WordPress.DB.RestrictedFunctions">
102-
<severity>7</severity>
103-
</rule>
104-
105-
<!-- Check for code WP does better -->
106-
<rule ref="WordPress.WP.AlternativeFunctions">
107-
<type>error</type>
108-
<exclude name="WordPress.WP.AlternativeFunctions.json_encode_json_encode"/>
109-
<exclude name="WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents"/>
110-
<exclude name="WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents"/>
111-
</rule>
112-
113-
<rule ref="Generic.PHP.ForbiddenFunctions">
114-
<properties>
115-
<property name="forbiddenFunctions" type="array">
116-
<element key="move_uploaded_file" value="null"/>
117-
<element key="passthru" value="null"/>
118-
<element key="proc_open" value="null"/>
119-
<element key="create_function" value="null"/>
120-
<element key="eval" value="null"/>
121-
<element key="str_rot13" value="null"/>
122-
</property>
123-
</properties>
124-
<type>error</type>
125-
<severity>7</severity>
126-
</rule>
127-
128-
<rule ref="Squiz.PHP.DiscouragedFunctions">
129-
<properties>
130-
<property name="forbiddenFunctions" type="array">
131-
<element key="set_time_limit" value="null"/>
132-
<element key="ini_set" value="null"/>
133-
<element key="ini_alter" value="null"/>
134-
<element key="dl" value="null"/>
135-
</property>
136-
</properties>
137-
</rule>
138-
139-
<!-- Check for use of deprecated WordPress classes, functions and function parameters. -->
140-
<rule ref="WordPress.WP.DeprecatedClasses"/>
141-
<rule ref="WordPress.WP.DeprecatedFunctions"/>
142-
<rule ref="WordPress.WP.DeprecatedParameters"/>
143-
<rule ref="WordPress.DateTime.RestrictedFunctions"/>
144-
145-
<!-- Check for deprecated WordPress constants. -->
146-
<rule ref="WordPress.WP.DiscouragedConstants">
147-
<type>error</type>
148-
<severity>7</severity>
149-
</rule>
150-
151-
<!-- Check for discouraged WordPress functions. -->
152-
<rule ref="WordPress.WP.DiscouragedFunctions">
153-
<severity>6</severity>
154-
</rule>
155-
156-
<!-- Check for usage of deprecated parameter values in WP functions and provide alternative based on the parameter passed. -->
157-
<rule ref="WordPress.WP.DeprecatedParameterValues">
158-
<severity>7</severity>
159-
</rule>
160-
161-
<!-- No ByteOrderMark allowed - important to prevent issues with content being sent before headers. -->
162-
<rule ref="Generic.Files.ByteOrderMark">
163-
<severity>7</severity>
164-
</rule>
165-
166-
<!-- Check for missing required function parameters. -->
167-
<rule ref="PluginCheck.CodeAnalysis.RequiredFunctionParameters">
168-
<severity>7</severity>
169-
</rule>
170-
171-
<!-- Check for discouraged load_plugin_textdomain() call. -->
172-
<rule ref="PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound">
173-
<type>error</type>
174-
<severity>7</severity>
175-
</rule>
33+
<rule ref="./plugin-check.ruleset.xml" />
17634

17735
</ruleset>

0 commit comments

Comments
 (0)