phpcs-security-audit icon indicating copy to clipboard operation
phpcs-security-audit copied to clipboard

Add skip for non native functions to lower false positives

Open jmarcil opened this issue 7 years ago • 1 comments

Following PR #20, we have other sniffers that could benefit from suppressing issues when ParanoiaMode == 0.

Watch out to not touch things such as mysqli::query (valid equivalent of mysqli_query).

jmarcil avatar Dec 13 '18 07:12 jmarcil

Looks like the solution from #20 and #42 could be applied to all non object based functions:

Validate if the token before is a T_OBJECT_OPERATOR and then skip it if it is.

On thing I need to put emphasis here for later: on a per bunch of function basis it's okay to remove even if paranoia is enabled, but for more broad changes I'd like it not to suppress results.

jmarcil avatar Aug 04 '19 20:08 jmarcil