Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sanitize your filter outputs to prevent mismatch with the type from the result #280

Open
CrochetFeve0251 opened this issue May 16, 2024 · 0 comments

Comments

@CrochetFeve0251
Copy link

CrochetFeve0251 commented May 16, 2024

Hey,
Now you are also group.one folks so why not helping each others?

I looked quickly at your code base and I saw two points that might interest you to improve as you are also a plugin used by millions of websites.

Is your feature request related to a problem? Please describe.
You added some filters into your plugin and it is a great practice.

However, I am seeing some potential troubles you can have with some clients miss using the filters.

As you are not validating or sanitizing the output of your filters it is possible to have invalid types being returned from that hooks potentially leading to a miss type.

This miss type can be invisible on certain parts of your code but on others like this one that can lead into warning or fatal.

Describe the solution you'd like
The best solution would be to validate hooks either by adding some manual logic or adding a dispatcher into the code that also take as parameter of the filter a sanitizer for the value like this library.
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Currently we are trying to see if there is a way to push that practice into the core: wp-media/wp-rocket#6629

@CrochetFeve0251 CrochetFeve0251 changed the title Sanitize your filter outputs Sanitize your filter outputs to prevent mismatch with the type from the result May 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant