Skip to content

Commit 5ff4667

Browse files
MocioFMocioF
committed
Refactoring code to reach PHPStan v. 2.0 Level 9
Signed-off-by: Giuseppe Foti <foti.giuseppe@gmail.com>
1 parent 7ef5b0d commit 5ff4667

26 files changed

+274
-163
lines changed

‎admin/class-no-unsafe-inline-admin.php

Lines changed: 50 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -393,7 +393,7 @@ public function nunil_set_screen(): void {
393393
if ( ! is_null( $current_screen ) ) {
394394
// Get the active tab from the $_GET param.
395395
$default_tab = null;
396-
$tab = isset( $_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : $default_tab;
396+
$tab = isset( $_GET['tab'] ) ? Utils::sanitize_text( $_GET['tab'] ) : $default_tab;
397397

398398
$help_tabs = new \NUNIL\Nunil_Admin_Help_Tabs( $current_screen );
399399

@@ -869,7 +869,7 @@ public function register_base_rule(): void {
869869
* Sanitize the settings
870870
*
871871
* @throws \NUNIL\Nunil_Exception Main option is not an array.
872-
* @param array<string|array<string>> $input Contains the settings.
872+
* @param array<string|int|array<int|string>> $input Contains the settings.
873873
* @return array<mixed>
874874
*/
875875
public function sanitize_options( $input ) {
@@ -1022,7 +1022,12 @@ public function sanitize_options( $input ) {
10221022

10231023
unset( $options['endpoints'] );
10241024
if ( isset( $input['endpoints'] ) && is_array( $input['endpoints'] ) ) {
1025-
$new_input['endpoints'] = array_map( 'esc_url_raw', $input['endpoints'], $protocols = array( array( 'https' ) ) );
1025+
$new_input['endpoints'] = array_map(
1026+
function ( $url ) {
1027+
return esc_url_raw( strval( $url ), array( 'https' ) );
1028+
},
1029+
$input['endpoints']
1030+
);
10261031
}
10271032

10281033
if ( isset( $input['max_response_header_size'] ) ) {
@@ -1106,6 +1111,12 @@ public function sanitize_base_rule( $input ) {
11061111
if ( is_array( $options ) ) {
11071112
$new_input = array_merge( $options, $new_input );
11081113
}
1114+
$new_input = array_map(
1115+
function ( $a ) {
1116+
return Utils::sanitize_text( $a, false );
1117+
},
1118+
$new_input
1119+
);
11091120
return $new_input;
11101121
}
11111122

@@ -1784,26 +1795,25 @@ public function print_endpoints(): void {
17841795
);
17851796

17861797
print( '<ol class="nunil-endpoints-list" id="nunil-endpoints-list">' );
1787-
if ( is_array( $endpoints ) ) {
1788-
// Add a line for each url.
1789-
foreach ( $endpoints as $index => $endpoint ) {
1790-
printf(
1791-
'<li>' .
1792-
'<button class="nunil-btn nunil-btn-del-endpoint" ' .
1793-
'id="no-unsafe-inline[del-endpoint][%d]" name="no-unsafe-inline[del-endpoint][%d]">' .
1794-
'<span class="dashicons dashicons-remove"> </span></button>' .
1795-
'<span class="nunil-endpoint-string txt-active">%s</span>' .
1796-
'<input class="nunil-hidden-endpoint" type="hidden" id="no-unsafe-inline[endpoints][%d]" ' .
1797-
'name="no-unsafe-inline[endpoints][%d]" value="%s" />' .
1798-
'</li>',
1799-
esc_html( $index ),
1800-
esc_html( $index ),
1801-
esc_html( $endpoint ),
1802-
esc_html( $index ),
1803-
esc_html( $index ),
1804-
esc_html( $endpoint )
1805-
);
1806-
}
1798+
// Add a line for each url.
1799+
foreach ( $endpoints as $index => $endpoint ) {
1800+
$endp_txt = strval( Utils::cast_strval( $endpoint ) );
1801+
printf(
1802+
'<li>' .
1803+
'<button class="nunil-btn nunil-btn-del-endpoint" ' .
1804+
'id="no-unsafe-inline[del-endpoint][%d]" name="no-unsafe-inline[del-endpoint][%d]">' .
1805+
'<span class="dashicons dashicons-remove"> </span></button>' .
1806+
'<span class="nunil-endpoint-string txt-active">%s</span>' .
1807+
'<input class="nunil-hidden-endpoint" type="hidden" id="no-unsafe-inline[endpoints][%d]" ' .
1808+
'name="no-unsafe-inline[endpoints][%d]" value="%s" />' .
1809+
'</li>',
1810+
esc_html( $index ),
1811+
esc_html( $index ),
1812+
esc_html( $endp_txt ),
1813+
esc_html( $index ),
1814+
esc_html( $index ),
1815+
esc_html( $endp_txt )
1816+
);
18071817
}
18081818
print( '</ol>' );
18091819
}
@@ -1990,7 +2000,7 @@ public function nunil_manage_options(): void {
19902000

19912001
// Get the active tab from the $_GET param.
19922002
$default_tab = null;
1993-
$tab = isset( $_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : $default_tab;
2003+
$tab = isset( $_GET['tab'] ) ? Utils::sanitize_text( $_GET['tab'], false ) : $default_tab;
19942004

19952005
?>
19962006
<div class="wrap">
@@ -2093,7 +2103,7 @@ public function nunil_manage_options(): void {
20932103
* @return mixed
20942104
*/
20952105
public function save_screen_options( $status, $option, $value ) {
2096-
$this_page = isset( $_REQUEST['page'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) : '';
2106+
$this_page = isset( $_REQUEST['page'] ) ? Utils::sanitize_text( $_REQUEST['page'], false ) : '';
20972107
switch ( $this_page ) {
20982108
case 'no-unsafe-inline':
20992109
return $value;
@@ -2191,7 +2201,7 @@ public function show_admin_notice(): void {
21912201

21922202
if ( $notice && is_array( $notice ) ) {
21932203
$type = $notice['type'];
2194-
$message = $notice['message'];
2204+
$message = Utils::sanitize_text( $notice['message'], false );
21952205

21962206
$allowed_html_in_notice = array(
21972207
'br' => array(),
@@ -2222,7 +2232,7 @@ public function show_admin_notice(): void {
22222232
public function trigger_clustering(): void {
22232233
if ( ! (
22242234
isset( $_REQUEST['nonce'] )
2225-
&& wp_verify_nonce( sanitize_key( $_REQUEST['nonce'] ), 'nunil_trigger_clustering_nonce' )
2235+
&& wp_verify_nonce( sanitize_key( strval( Utils::cast_strval( $_REQUEST['nonce'] ) ) ), 'nunil_trigger_clustering_nonce' )
22262236
) ) {
22272237
exit( esc_html__( 'Nope! Security check failed!', 'no-unsafe-inline' ) );
22282238
}
@@ -2231,10 +2241,10 @@ public function trigger_clustering(): void {
22312241

22322242
$result = $obj->cluster_by_dbscan();
22332243

2234-
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && strtolower( sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_REQUESTED_WITH'] ) ) ) === 'xmlhttprequest' ) {
2244+
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && Utils::sanitize_text( $_SERVER['HTTP_X_REQUESTED_WITH'] ) === 'xmlhttprequest' ) {
22352245
echo wp_json_encode( $result );
22362246
} elseif ( isset( $_SERVER['HTTP_REFERER'] ) ) {
2237-
header( 'Location: ' . esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) );
2247+
header( 'Location: ' . esc_url_raw( wp_unslash( strval( Utils::cast_strval( $_SERVER['HTTP_REFERER'] ) ) ) ) );
22382248
}
22392249

22402250
wp_die();
@@ -2249,7 +2259,7 @@ public function trigger_clustering(): void {
22492259
public function clean_database(): void {
22502260
if ( ! (
22512261
isset( $_REQUEST['nonce'] )
2252-
&& wp_verify_nonce( sanitize_key( $_REQUEST['nonce'] ), 'nunil_trigger_clean_database' )
2262+
&& wp_verify_nonce( sanitize_key( strval( Utils::cast_strval( $_REQUEST['nonce'] ) ) ), 'nunil_trigger_clean_database' )
22532263
) ) {
22542264
exit( esc_html__( 'Nope! Security check failed!', 'no-unsafe-inline' ) );
22552265
}
@@ -2282,10 +2292,10 @@ public function clean_database(): void {
22822292
'report' => $result_string,
22832293
);
22842294

2285-
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && strtolower( sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_REQUESTED_WITH'] ) ) ) === 'xmlhttprequest' ) {
2295+
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && Utils::sanitize_text( $_SERVER['HTTP_X_REQUESTED_WITH'] ) === 'xmlhttprequest' ) {
22862296
echo wp_json_encode( $result );
22872297
} elseif ( isset( $_SERVER['HTTP_REFERER'] ) ) {
2288-
header( 'Location: ' . esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) );
2298+
header( 'Location: ' . esc_url_raw( wp_unslash( strval( Utils::cast_strval( $_SERVER['HTTP_REFERER'] ) ) ) ) );
22892299
}
22902300

22912301
wp_die();
@@ -2300,7 +2310,7 @@ public function clean_database(): void {
23002310
public function prune_database(): void {
23012311
if ( ! (
23022312
isset( $_REQUEST['nonce'] )
2303-
&& wp_verify_nonce( sanitize_key( $_REQUEST['nonce'] ), 'nunil_trigger_prune_database' )
2313+
&& wp_verify_nonce( sanitize_key( strval( Utils::cast_strval( $_REQUEST['nonce'] ) ) ), 'nunil_trigger_prune_database' )
23042314
) ) {
23052315
exit( esc_html__( 'Nope! Security check failed!', 'no-unsafe-inline' ) );
23062316
}
@@ -2321,10 +2331,10 @@ public function prune_database(): void {
23212331
'report' => $result_string,
23222332
);
23232333

2324-
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && strtolower( sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_REQUESTED_WITH'] ) ) ) === 'xmlhttprequest' ) {
2334+
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && Utils::sanitize_text( $_SERVER['HTTP_X_REQUESTED_WITH'] ) === 'xmlhttprequest' ) {
23252335
echo wp_json_encode( $result );
23262336
} elseif ( isset( $_SERVER['HTTP_REFERER'] ) ) {
2327-
header( 'Location: ' . esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) );
2337+
header( 'Location: ' . esc_url_raw( wp_unslash( strval( Utils::cast_strval( $_SERVER['HTTP_REFERER'] ) ) ) ) );
23282338
}
23292339

23302340
wp_die();
@@ -2345,10 +2355,10 @@ public function update_summary_tables(): void {
23452355
$result['inline'] = DB::get_database_summary_data( 'inline_scripts' );
23462356
$result['events'] = DB::get_database_summary_data( 'event_handlers' );
23472357

2348-
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && strtolower( sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_REQUESTED_WITH'] ) ) ) === 'xmlhttprequest' ) {
2358+
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && Utils::sanitize_text( $_SERVER['HTTP_X_REQUESTED_WITH'] ) === 'xmlhttprequest' ) {
23492359
echo wp_json_encode( $result );
23502360
} elseif ( isset( $_SERVER['HTTP_REFERER'] ) ) {
2351-
header( 'Location: ' . esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) );
2361+
header( 'Location: ' . esc_url_raw( wp_unslash( strval( Utils::cast_strval( $_SERVER['HTTP_REFERER'] ) ) ) ) );
23522362
}
23532363

23542364
wp_die();
@@ -2526,7 +2536,7 @@ public static function output_summary_eventhandlers_table() {
25262536
public function test_classifier(): void {
25272537
if ( ! (
25282538
isset( $_REQUEST['nonce'] )
2529-
&& wp_verify_nonce( sanitize_key( $_REQUEST['nonce'] ), 'nunil_test_classifier_nonce' )
2539+
&& wp_verify_nonce( sanitize_key( strval( Utils::cast_strval( $_REQUEST['nonce'] ) ) ), 'nunil_test_classifier_nonce' )
25302540
) ) {
25312541
exit( esc_html__( 'Nope! Security check failed!', 'no-unsafe-inline' ) );
25322542
}
@@ -2537,10 +2547,10 @@ public function test_classifier(): void {
25372547
'type' => 'success',
25382548
'report' => $result_string,
25392549
);
2540-
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && strtolower( sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_REQUESTED_WITH'] ) ) ) === 'xmlhttprequest' ) {
2550+
if ( ! empty( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && Utils::sanitize_text( $_SERVER['HTTP_X_REQUESTED_WITH'] ) === 'xmlhttprequest' ) {
25412551
echo wp_json_encode( $result );
25422552
} elseif ( isset( $_SERVER['HTTP_REFERER'] ) ) {
2543-
header( 'Location: ' . esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) );
2553+
header( 'Location: ' . esc_url_raw( wp_unslash( strval( Utils::cast_strval( $_SERVER['HTTP_REFERER'] ) ) ) ) );
25442554
}
25452555

25462556
wp_die();

‎admin/partials/class-no-unsafe-inline-admin-logs-table.php

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,14 @@
1212

1313
namespace NUNIL\admin\partials;
1414

15+
use NUNIL\Nunil_Lib_Utils as Utils;
16+
1517
if ( ! class_exists( 'WP_List_Table' ) ) {
18+
/**
19+
* Requires a core wp file.
20+
*
21+
* @phpstan-ignore requireOnce.fileNotFound
22+
*/
1623
require_once ABSPATH . 'wp-admin/includes/class-wp-list-table.php';
1724
}
1825

@@ -50,7 +57,7 @@ public function __construct() {
5057
public function column_default( $item, $column_name ) {
5158
$content = $item['created_at'] . ' | ' . strtoupper( $item['level'] ) . ' | ' . $item['message'];
5259

53-
if ( is_string( $content ) && strlen( $content ) > self::MAX_LENGTH ) {
60+
if ( strlen( $content ) > self::MAX_LENGTH ) {
5461
return substr( $content, 0, self::MAX_LENGTH ) . '...';
5562
} else {
5663
return $content;
@@ -88,7 +95,7 @@ public function get_sortable_columns() {
8895
* @return void
8996
*/
9097
public function prepare_items() {
91-
$per_page = 500;
98+
$per_page = 50;
9299

93100
$columns = $this->get_columns();
94101
$sortable = $this->get_sortable_columns();
@@ -97,9 +104,9 @@ public function prepare_items() {
97104

98105
$total_items = \NUNIL\Nunil_Lib_Db::get_total_logs();
99106

100-
$paged = isset( $_REQUEST['paged'] ) ? max( 0, intval( $_REQUEST['paged'] ) - 1 ) : 0;
107+
$paged = isset( $_REQUEST['paged'] ) ? max( 0, intval( Utils::cast_intval( $_REQUEST['paged'] ) ) - 1 ) : 0;
101108
$orderby = ( isset( $_REQUEST['orderby'] ) && in_array( $_REQUEST['orderby'], array_keys( $this->get_sortable_columns() ), true ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : 'created_at';
102-
$order = ( isset( $_REQUEST['order'] ) && in_array( $_REQUEST['order'], array( 'asc', 'desc' ) ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'desc';
109+
$order = ( isset( $_REQUEST['order'] ) && in_array( $_REQUEST['order'], array( 'asc', 'desc' ) ) ) ? Utils::sanitize_text( $_REQUEST['order'], false ) : 'desc';
103110

104111
try {
105112
$logs = \NUNIL\Nunil_Lib_Db::get_logs( $paged * $per_page, $per_page, $orderby, $order, ARRAY_A );

‎admin/partials/class-no-unsafe-inline-base-rule-list.php

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@
1414
defined( 'ABSPATH' ) || die( 'you do not have acces to this page!' );
1515

1616
if ( ! class_exists( 'WP_List_Table' ) ) {
17+
/**
18+
* Requires a core wp file.
19+
*
20+
* @phpstan-ignore requireOnce.fileNotFound
21+
*/
1722
require_once ABSPATH . 'wp-admin/includes/class-wp-list-table.php';
1823
}
1924

@@ -43,7 +48,7 @@ public function __construct() {
4348
*
4449
* @since @1.0.0
4550
*
46-
* @return array<array{ID: int, directive: string, source: string}>>
51+
* @return array<array{ID: int, directive: string, source: string}>
4752
*/
4853
public static function get_sources() {
4954
$basesrc = new \NUNIL\Nunil_Base_Src_Rules();

‎admin/partials/class-no-unsafe-inline-events-list.php

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@
2121
}
2222

2323
if ( ! class_exists( 'WP_List_Table' ) ) {
24+
/**
25+
* Requires a core wp file.
26+
*
27+
* @phpstan-ignore requireOnce.fileNotFound
28+
*/
2429
require_once ABSPATH . 'wp-admin/includes/class-wp-list-table.php';
2530
}
2631

@@ -100,7 +105,7 @@ public function process_bulk_action() {
100105
} elseif ( isset( $_GET['action'] ) && isset( $_GET['_wpnonce'] ) && is_string( $_GET['_wpnonce'] ) ) {
101106
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: We are not processing form information; $nonce is used only for wp_verify_nonce
102107
$nonce = wp_unslash( $_GET['_wpnonce'] );
103-
$action = ( isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash( $_GET['action'] ) ) : '' );
108+
$action = ( isset( $_GET['action'] ) ? Utils::sanitize_text( $_GET['action'], false ) : '' );
104109
} else {
105110
$action = '';
106111
$nonce = '';
@@ -112,7 +117,7 @@ public function process_bulk_action() {
112117
wp_die( esc_html__( 'Nope! Security check failed!', 'no-unsafe-inline' ) );
113118
}
114119
if ( isset( $_GET['script_id'] ) ) {
115-
$script_id = sanitize_text_field( wp_unslash( $_GET['script_id'] ) );
120+
$script_id = Utils::sanitize_text( $_GET['script_id'], false );
116121
$affected = DB::evh_whitelist( $script_id );
117122
}
118123
break;
@@ -131,7 +136,7 @@ public function process_bulk_action() {
131136
wp_die( esc_html__( 'Nope! Security check failed!', 'no-unsafe-inline' ) );
132137
}
133138
if ( isset( $_GET['script_id'] ) ) {
134-
$script_id = sanitize_text_field( wp_unslash( $_GET['script_id'] ) );
139+
$script_id = Utils::sanitize_text( $_GET['script_id'], false );
135140
$affected = DB::evh_whitelist( $script_id, false );
136141
}
137142
break;
@@ -150,7 +155,7 @@ public function process_bulk_action() {
150155
wp_die( esc_html__( 'Nope! Security check failed!', 'no-unsafe-inline' ) );
151156
}
152157
if ( isset( $_GET['script_id'] ) ) {
153-
$script_id = sanitize_text_field( wp_unslash( $_GET['script_id'] ) );
158+
$script_id = Utils::sanitize_text( $_GET['script_id'], false );
154159
$affected = DB::evh_delete( $script_id );
155160
}
156161
break;
@@ -169,7 +174,7 @@ public function process_bulk_action() {
169174
wp_die( esc_html__( 'Nope! Security check failed!', 'no-unsafe-inline' ) );
170175
}
171176
if ( isset( $_GET['script_id'] ) ) {
172-
$script_id = sanitize_text_field( wp_unslash( $_GET['script_id'] ) );
177+
$script_id = Utils::sanitize_text( $_GET['script_id'], false );
173178
$affected = DB::evh_uncluster( $script_id );
174179
}
175180
break;
@@ -380,7 +385,7 @@ public function get_columns() {
380385
*/
381386
public function prepare_items() {
382387
if ( isset( $_REQUEST['s'] ) ) {
383-
$search = sanitize_text_field( wp_unslash( $_REQUEST['s'] ) );
388+
$search = Utils::sanitize_text( $_REQUEST['s'], false );
384389
} else {
385390
$search = '';
386391
}
@@ -401,7 +406,7 @@ public function prepare_items() {
401406
$per_page = 20;
402407
}
403408

404-
$paged = isset( $_REQUEST['paged'] ) ? max( 0, intval( $_REQUEST['paged'] - 1 ) * $per_page ) : 0;
409+
$paged = isset( $_REQUEST['paged'] ) ? max( 0, ( intval( Utils::cast_intval( $_REQUEST['paged'] ) ) - 1 ) * $per_page ) : 0;
405410

406411
$order = ( isset( $_REQUEST['order'] ) && in_array( $_REQUEST['order'], array( 'ASC', 'DESC', 'asc', 'desc' ), true ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'ASC';
407412

0 commit comments

Comments
 (0)