From 12bd2a919e6d9057e644a14170fa2964c2b350f3 Mon Sep 17 00:00:00 2001
From: ai-anant <ant2010in@gmail.com>
Date: Tue, 28 Jul 2026 11:25:05 +0530
Subject: [PATCH 1/2] Update rules for WordPress Coding Standards 3.4.0/3.4.1

Changes based on WPCS v3.4.0 (2026-07-14) and v3.4.1 security release (2026-07-27):

1. Add WP 7.0.0 deprecated functions to deprecated.yaml
   - addslashes_gpc() -> wp_slash()
   - block_core_navigation_block_contains_core_navigation()
     -> block_core_navigation_block_tree_has_block_type()
   - wp_sanitize_script_attributes()
     -> wp_get_script_tag() or wp_get_inline_script_tag()

2. New rule: silenced-errors/parse_url.yaml
   - WPCS 3.4.0 removed parse_url() from the allowed error suppression list
   - Flags @parse_url() usage
   - Also includes @unserialize() detection

3. Enqueued-resources.yaml: add user-controlled version param rule
   - Detects user input (//) in
     wp_enqueue_script() and wp_enqueue_style() version params
   - Related to EnqueuedResourceParametersSniff security advisory (GHSA-3pwp-g2mj-5p3v)
---
 .../silenced-errors/parse_url.yaml            | 47 +++++++++++++++++++
 .../wordpress-security/deprecated.yaml        |  4 ++
 .../enqueued-resources.yaml                   | 45 +++++++++++++++---
 3 files changed, 89 insertions(+), 7 deletions(-)
 create mode 100644 php/coding-standards/php-security/silenced-errors/parse_url.yaml

diff --git a/php/coding-standards/php-security/silenced-errors/parse_url.yaml b/php/coding-standards/php-security/silenced-errors/parse_url.yaml
new file mode 100644
index 0000000..60f572d
--- /dev/null
+++ b/php/coding-standards/php-security/silenced-errors/parse_url.yaml
@@ -0,0 +1,47 @@
+rules:
+  # ============================================================================
+  # ERROR SUPPRESSION WITH parse_url()
+  # Source: WordPress-Coding-Standards/WordPress/Sniffs/PHP/NoSilencedErrorsSniff.php
+  # License: MIT - Copyright (c) 2009 John Godley and contributors
+  #
+  # WPCS 3.4.0 removed parse_url() from the list of functions where error
+  # silencing (@) is permitted. Previously, an E_WARNING was thrown when
+  # URL parsing failed in PHP < 5.3.3, but modern PHP handles this gracefully
+  # and the @ operator hides legitimate errors during development/debugging.
+  # ============================================================================
+
+  - id: codevigilant.php.coding-standards.error-handling.silenced_parse_url
+    message: "Do not use @ error suppression with parse_url(). Remove the @ operator and validate the return value with proper error checking instead."
+    severity: WARNING
+    languages: [php]
+    patterns:
+      - pattern: "@parse_url(...)"
+    metadata:
+      category: best-practice
+      cwe: "CWE-754: Improper Check for Unusual or Exceptional Conditions"
+      owasp: "A04:2021 - Insecure Design"
+      technology: php
+      confidence: HIGH
+      references:
+        - https://developer.wordpress.org/reference/functions/wp_parse_url/
+        - https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/WordPress/Sniffs/PHP/NoSilencedErrorsSniff.php
+      source: WordPress-Coding-Standards
+      license: MIT
+
+  - id: codevigilant.php.coding-standards.error-handling.silenced_unserialize
+    message: "Do not use @ error suppression with unserialize(). Remove the @ operator and validate the return value. Consider using json_decode() for untrusted data."
+    severity: WARNING
+    languages: [php]
+    patterns:
+      - pattern: "@unserialize(...)"
+    metadata:
+      category: security
+      cwe: "CWE-502: Deserialization of Untrusted Data"
+      owasp: "A08:2021 - Software and Data Integrity Failures"
+      technology: php
+      confidence: HIGH
+      references:
+        - https://www.php.net/manual/en/function.unserialize.php
+        - https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/WordPress/Sniffs/PHP/NoSilencedErrorsSniff.php
+      source: WordPress-Coding-Standards
+      license: MIT
diff --git a/php/coding-standards/wordpress-security/deprecated.yaml b/php/coding-standards/wordpress-security/deprecated.yaml
index 48e7e94..f96289a 100644
--- a/php/coding-standards/wordpress-security/deprecated.yaml
+++ b/php/coding-standards/wordpress-security/deprecated.yaml
@@ -87,6 +87,10 @@ rules:
           - pattern: the_category_head(...)
           - pattern: previous_post(...)
           - pattern: next_post(...)
+          # WP 7.0.0 deprecated functions (WPCS 3.4.0 update)
+          - pattern: addslashes_gpc(...)
+          - pattern: block_core_navigation_block_contains_core_navigation(...)
+          - pattern: wp_sanitize_script_attributes(...)
     metadata:
       category: security
       cwe: "CWE-477"
diff --git a/php/coding-standards/wordpress-security/enqueued-resources.yaml b/php/coding-standards/wordpress-security/enqueued-resources.yaml
index 83d8f99..343eec3 100644
--- a/php/coding-standards/wordpress-security/enqueued-resources.yaml
+++ b/php/coding-standards/wordpress-security/enqueued-resources.yaml
@@ -2,6 +2,7 @@ rules:
   # ============================================================================
   # ENQUEUED RESOURCES RULES
   # Source: WordPress-Coding-Standards/WordPress/Sniffs/WP/EnqueuedResourcesSniff.php
+  #         WordPress-Coding-Standards/WordPress/Sniffs/WP/EnqueuedResourceParametersSniff.php
   # License: MIT - Copyright (c) 2009 John Godley and contributors
   # ============================================================================
 
@@ -11,9 +12,9 @@ rules:
     languages: [php]
     patterns:
       - pattern-either:
-          - pattern: echo "<script";
-          - pattern: echo '<script';
-          - pattern: print "<script";
+          - pattern: echo "&lt;script";
+          - pattern: echo '&lt;script';
+          - pattern: print "&lt;script";
     metadata:
       category: security
       cwe: "CWE-79"
@@ -27,14 +28,14 @@ rules:
       license: MIT
 
   - id: codevigilant.php.coding-standards.xss.inline_style_tag
-    message: "Use wp_enqueue_style() instead of inline <link> or <style> tags for proper dependency management."
+    message: "Use wp_enqueue_style() instead of inline &lt;link> or &lt;style> tags for proper dependency management."
     severity: WARNING
     languages: [php]
     patterns:
       - pattern-either:
-          - pattern: echo "<link";
-          - pattern: echo '<link';
-          - pattern: print "<link";
+          - pattern: echo "&lt;link";
+          - pattern: echo '&lt;link';
+          - pattern: print "&lt;link";
     metadata:
       category: security
       cwe: "CWE-79"
@@ -45,3 +46,33 @@ rules:
         - https://developer.wordpress.org/reference/functions/wp_enqueue_style/
       source: WordPress-Coding-Standards
       license: MIT
+
+  - id: codevigilant.php.coding-standards.xss.user_controlled_version_param
+    message: "Version parameter in wp_enqueue_script() or wp_enqueue_style() should not contain user-controlled input. Use a hardcoded version string or plugin version constant."
+    severity: WARNING
+    languages: [php]
+    patterns:
+      - pattern-either:
+          - pattern: |
+              wp_enqueue_script(..., $_GET[...], ...)
+          - pattern: |
+              wp_enqueue_script(..., $_POST[...], ...)
+          - pattern: |
+              wp_enqueue_script(..., $_REQUEST[...], ...)
+          - pattern: |
+              wp_enqueue_style(..., $_GET[...], ...)
+          - pattern: |
+              wp_enqueue_style(..., $_POST[...], ...)
+          - pattern: |
+              wp_enqueue_style(..., $_REQUEST[...], ...)
+    metadata:
+      category: security
+      cwe: "CWE-94: Improper Control of Generation of Code"
+      owasp: "A03:2021 - Injection"
+      technology: wordpress
+      confidence: HIGH
+      references:
+        - https://developer.wordpress.org/reference/functions/wp_enqueue_script/
+        - https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/WordPress/Sniffs/WP/EnqueuedResourceParametersSniff.php
+      source: WordPress-Coding-Standards
+      license: MIT

From be880692888adb81e4d172c17217f7a7bbe75e89 Mon Sep 17 00:00:00 2001
From: ai-anant <ant2010in@gmail.com>
Date: Tue, 28 Jul 2026 11:36:06 +0530
Subject: [PATCH 2/2] Fix bugs found in self-review

- Fix inline_script_tag/inline_style_tag: patterns were using unterminated
  PHP string literals and HTML-entity-corrupted versions, both non-functional.
  Switched to pattern-regex for <script and <link detection.
- Fix enqueued-resources message: user input in ANY argument position is
  detected (not just version param), so message now reflects that.
- Fix @unserialize rule: WPCS still allows it in its suppression list;
  added notes field documenting this is defense-in-depth.
- Remove duplicate get_user_by_email pattern in deprecated.yaml (pre-existing)
---
 .../php-security/silenced-errors/parse_url.yaml  |  1 +
 .../wordpress-security/deprecated.yaml           |  1 -
 .../wordpress-security/enqueued-resources.yaml   | 16 ++++++++--------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/php/coding-standards/php-security/silenced-errors/parse_url.yaml b/php/coding-standards/php-security/silenced-errors/parse_url.yaml
index 60f572d..5a16b63 100644
--- a/php/coding-standards/php-security/silenced-errors/parse_url.yaml
+++ b/php/coding-standards/php-security/silenced-errors/parse_url.yaml
@@ -45,3 +45,4 @@ rules:
         - https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/WordPress/Sniffs/PHP/NoSilencedErrorsSniff.php
       source: WordPress-Coding-Standards
       license: MIT
+      notes: "Defense-in-depth: WPCS still allows @unserialize() but suppressing errors on deserialization hides return-value failures that are critical for security."
diff --git a/php/coding-standards/wordpress-security/deprecated.yaml b/php/coding-standards/wordpress-security/deprecated.yaml
index f96289a..4c32259 100644
--- a/php/coding-standards/wordpress-security/deprecated.yaml
+++ b/php/coding-standards/wordpress-security/deprecated.yaml
@@ -77,7 +77,6 @@ rules:
     patterns:
       - pattern-either:
           - pattern: get_currentuserinfo()
-          - pattern: get_user_by_email(...)
           - pattern: get_userdatabylogin(...)
           - pattern: get_user_by_email(...)
           - pattern: wp_get_single_post(...)
diff --git a/php/coding-standards/wordpress-security/enqueued-resources.yaml b/php/coding-standards/wordpress-security/enqueued-resources.yaml
index 343eec3..97c51c1 100644
--- a/php/coding-standards/wordpress-security/enqueued-resources.yaml
+++ b/php/coding-standards/wordpress-security/enqueued-resources.yaml
@@ -12,9 +12,9 @@ rules:
     languages: [php]
     patterns:
       - pattern-either:
-          - pattern: echo "&lt;script";
-          - pattern: echo '&lt;script';
-          - pattern: print "&lt;script";
+          - pattern-regex: echo\s*"<script
+          - pattern-regex: echo\s*'<script
+          - pattern-regex: print\s*"<script
     metadata:
       category: security
       cwe: "CWE-79"
@@ -28,14 +28,14 @@ rules:
       license: MIT
 
   - id: codevigilant.php.coding-standards.xss.inline_style_tag
-    message: "Use wp_enqueue_style() instead of inline &lt;link> or &lt;style> tags for proper dependency management."
+    message: "Use wp_enqueue_style() instead of inline <link> or <style> tags for proper dependency management."
     severity: WARNING
     languages: [php]
     patterns:
       - pattern-either:
-          - pattern: echo "&lt;link";
-          - pattern: echo '&lt;link';
-          - pattern: print "&lt;link";
+          - pattern-regex: echo\s*"<link
+          - pattern-regex: echo\s*'<link
+          - pattern-regex: print\s*"<link
     metadata:
       category: security
       cwe: "CWE-79"
@@ -48,7 +48,7 @@ rules:
       license: MIT
 
   - id: codevigilant.php.coding-standards.xss.user_controlled_version_param
-    message: "Version parameter in wp_enqueue_script() or wp_enqueue_style() should not contain user-controlled input. Use a hardcoded version string or plugin version constant."
+    message: "User-controlled input detected in wp_enqueue_script() or wp_enqueue_style() arguments. This could allow injection attacks if unsanitized input reaches the handle, src, or version parameters. Use hardcoded values or plugin version constants."
     severity: WARNING
     languages: [php]
     patterns: