Update rules to align with WordPress Coding Standards 3.4.0/3.4.1

php/coding-standards/php-security/silenced-errors/parse_url.yaml

@@ -0,0 +1,48 @@
+rules:
+  # ============================================================================
+  # ERROR SUPPRESSION WITH parse_url()
+  # Source: WordPress-Coding-Standards/WordPress/Sniffs/PHP/NoSilencedErrorsSniff.php
+  # License: MIT - Copyright (c) 2009 John Godley and contributors
+  #
+  # WPCS 3.4.0 removed parse_url() from the list of functions where error
+  # silencing (@) is permitted. Previously, an E_WARNING was thrown when
+  # URL parsing failed in PHP < 5.3.3, but modern PHP handles this gracefully
+  # and the @ operator hides legitimate errors during development/debugging.
+  # ============================================================================
+
+  - id: codevigilant.php.coding-standards.error-handling.silenced_parse_url
+    message: "Do not use @ error suppression with parse_url(). Remove the @ operator and validate the return value with proper error checking instead."
+    severity: WARNING
+    languages: [php]
+    patterns:
+      - pattern: "@parse_url(...)"
+    metadata:
+      category: best-practice
+      cwe: "CWE-754: Improper Check for Unusual or Exceptional Conditions"
+      owasp: "A04:2021 - Insecure Design"
+      technology: php
+      confidence: HIGH
+      references:
+        - https://developer.wordpress.org/reference/functions/wp_parse_url/
+        - https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/WordPress/Sniffs/PHP/NoSilencedErrorsSniff.php
+      source: WordPress-Coding-Standards
+      license: MIT
+
+  - id: codevigilant.php.coding-standards.error-handling.silenced_unserialize
+    message: "Do not use @ error suppression with unserialize(). Remove the @ operator and validate the return value. Consider using json_decode() for untrusted data."
+    severity: WARNING
+    languages: [php]
+    patterns:
+      - pattern: "@unserialize(...)"
+    metadata:
+      category: security
+      cwe: "CWE-502: Deserialization of Untrusted Data"
+      owasp: "A08:2021 - Software and Data Integrity Failures"
+      technology: php
+      confidence: HIGH
+      references:
+        - https://www.php.net/manual/en/function.unserialize.php
+        - https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/WordPress/Sniffs/PHP/NoSilencedErrorsSniff.php
+      source: WordPress-Coding-Standards
+      license: MIT
+      notes: "Defense-in-depth: WPCS still allows @unserialize() but suppressing errors on deserialization hides return-value failures that are critical for security."

php/coding-standards/wordpress-security/deprecated.yaml

@@ -77,7 +77,6 @@ rules:
     patterns:
       - pattern-either:
           - pattern: get_currentuserinfo()
-          - pattern: get_user_by_email(...)
           - pattern: get_userdatabylogin(...)
           - pattern: get_user_by_email(...)
           - pattern: wp_get_single_post(...)
@@ -87,6 +86,10 @@ rules:
           - pattern: the_category_head(...)
           - pattern: previous_post(...)
           - pattern: next_post(...)
+          # WP 7.0.0 deprecated functions (WPCS 3.4.0 update)
+          - pattern: addslashes_gpc(...)
+          - pattern: block_core_navigation_block_contains_core_navigation(...)
+          - pattern: wp_sanitize_script_attributes(...)
     metadata:
       category: security
       cwe: "CWE-477"

php/coding-standards/wordpress-security/enqueued-resources.yaml

@@ -2,6 +2,7 @@ rules:
   # ============================================================================
   # ENQUEUED RESOURCES RULES
   # Source: WordPress-Coding-Standards/WordPress/Sniffs/WP/EnqueuedResourcesSniff.php
+  #         WordPress-Coding-Standards/WordPress/Sniffs/WP/EnqueuedResourceParametersSniff.php
   # License: MIT - Copyright (c) 2009 John Godley and contributors
   # ============================================================================
 
@@ -11,9 +12,9 @@ rules:
     languages: [php]
     patterns:
       - pattern-either:
-          - pattern: echo "<script";
-          - pattern: echo '<script';
-          - pattern: print "<script";
+          - pattern-regex: echo\s*"<script
+          - pattern-regex: echo\s*'<script
+          - pattern-regex: print\s*"<script
     metadata:
       category: security
       cwe: "CWE-79"
@@ -32,9 +33,9 @@ rules:
     languages: [php]
     patterns:
       - pattern-either:
-          - pattern: echo "<link";
-          - pattern: echo '<link';
-          - pattern: print "<link";
+          - pattern-regex: echo\s*"<link
+          - pattern-regex: echo\s*'<link
+          - pattern-regex: print\s*"<link
     metadata:
       category: security
       cwe: "CWE-79"
@@ -45,3 +46,33 @@ rules:
         - https://developer.wordpress.org/reference/functions/wp_enqueue_style/
       source: WordPress-Coding-Standards
       license: MIT
+
+  - id: codevigilant.php.coding-standards.xss.user_controlled_version_param
+    message: "User-controlled input detected in wp_enqueue_script() or wp_enqueue_style() arguments. This could allow injection attacks if unsanitized input reaches the handle, src, or version parameters. Use hardcoded values or plugin version constants."
+    severity: WARNING
+    languages: [php]
+    patterns:
+      - pattern-either:
+          - pattern: |
+              wp_enqueue_script(..., $_GET[...], ...)
+          - pattern: |
+              wp_enqueue_script(..., $_POST[...], ...)
+          - pattern: |
+              wp_enqueue_script(..., $_REQUEST[...], ...)
+          - pattern: |
+              wp_enqueue_style(..., $_GET[...], ...)
+          - pattern: |
+              wp_enqueue_style(..., $_POST[...], ...)
+          - pattern: |
+              wp_enqueue_style(..., $_REQUEST[...], ...)
+    metadata:
+      category: security
+      cwe: "CWE-94: Improper Control of Generation of Code"
+      owasp: "A03:2021 - Injection"
+      technology: wordpress
+      confidence: HIGH
+      references:
+        - https://developer.wordpress.org/reference/functions/wp_enqueue_script/
+        - https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/WordPress/Sniffs/WP/EnqueuedResourceParametersSniff.php
+      source: WordPress-Coding-Standards
+      license: MIT