WordPress-Coding-Standards
WordPress-Coding-Standards copied to clipboard
Treat `ceil()`, `floor()`, and `round()` as safe for output
Is your feature request related to a problem?
When outputting a numeric value as an integer, the absint() and intval() functions are treated as safe for output by WPCS. The same is not true for ceil(), floor(), and round().
Describe the solution you'd like
The ceil(), floor(), and round() functions should be added to the Sniff:$escapingFunctions property.
Would make sense to actually extend it to all functions that return int or float, since that is always safe for output
EDIT: Since the PR https://github.com/WordPress/WordPress-Coding-Standards/pull/2082 got stuck due to missing maintainer feedback after initial review, I closed it. I just added it to my XML now with a couple additional functions.
Here's how I did it, by just grep-ing the native types from psalm:
grep -Poh '(?<=^'\'')\w+(?='\'' => \['\''(?>\??(?>(?>positive-)?int(?><(?>min|-?\d+), ?(?>max|-?\d+)>)?|float|\d+|numeric(?>-string)?|bool|false|true|null)\|)*(?>\??(?>(?>positive-)?int(?><(?>min|-?\d+), ?(?>max|-?\d+)>)?|float|\d+|numeric(?>-string)?)[|'\''])+(?>\??(?>(?>positive-)?int(?><(?>min|-?\d+), ?(?>max|-?\d+)>)?|float|\d+|numeric(?>-string)?|bool|false|true|null)[|'\''])*[,\]])' vendor/vimeo/psalm/dictionaries/CallMap.php | grep -vE '^(echo|v?f?printf?|trigger_error|exit|die|ps_\w+)$' | sed 's/^/<element value="/' | sed 's#$#"/>#'
functions (excluding all methods) that return: int positive-int int<-100, -20> int<min, max> float literal ints like 0|5 numeric numeric-string ?int (nullable of any of the above)
and their union return type may additionally contain any of bool false true null
If you want to get only functions that have at least 1 parameter, change [,\]] at the end to ,
e.g. in case you want to separate customAutoEscaped and customEscapingFunctions
Additionally all printing and exit functions are excluded
Elements are formatted so you can just copy and paste it to your .xml in customEscapingFunctions (since there's no difference between those and autoescaped functions anyway, see https://github.com/WordPress/WordPress-Coding-Standards/issues/2411)