diff --git a/WordPress-VIP-Go/ruleset-test.inc b/WordPress-VIP-Go/ruleset-test.inc index df6e313c..61e56955 100644 --- a/WordPress-VIP-Go/ruleset-test.inc +++ b/WordPress-VIP-Go/ruleset-test.inc @@ -253,10 +253,10 @@ $test = @in_array( $array, $needle, true ); // Error. // WordPressVIPMinimum.Security.ProperEscapingFunction.htmlAttrNotByEscHTML echo ''; // Error. -echo ''; // Warning. +echo ''; // Error. echo ''; // OK. ?>Hello -Hey +Hey 1, 252 => 1, 255 => 1, + 256 => 1, 258 => 1, + 259 => 1, 318 => 1, 329 => 1, 334 => 1, @@ -191,8 +193,6 @@ 245 => 1, 246 => 1, 247 => 1, - 256 => 1, - 259 => 1, 265 => 1, 269 => 1, 273 => 1, diff --git a/WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php b/WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php index e30af7c3..9b9513f0 100644 --- a/WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php +++ b/WordPressVIPMinimum/Sniffs/Security/ProperEscapingFunctionSniff.php @@ -205,8 +205,8 @@ public function process_token( $stackPtr ) { if ( $escaping_type === 'html' ) { $message = 'Wrong escaping function. HTML attributes should be escaped by `esc_attr()`, not by `%s()`.'; - $this->phpcsFile->addWarning( $message, $stackPtr, 'htmlAttrNotByEscHTML', $data ); - return; // Warning level because sub-optimal due to different filters, but still OK. + $this->phpcsFile->addError( $message, $stackPtr, 'htmlAttrNotByEscHTML', $data ); + return; } } diff --git a/WordPressVIPMinimum/Tests/Security/ProperEscapingFunctionUnitTest.inc b/WordPressVIPMinimum/Tests/Security/ProperEscapingFunctionUnitTest.inc index 35c66e49..af65ab5f 100644 --- a/WordPressVIPMinimum/Tests/Security/ProperEscapingFunctionUnitTest.inc +++ b/WordPressVIPMinimum/Tests/Security/ProperEscapingFunctionUnitTest.inc @@ -12,15 +12,15 @@ echo ''; // OK. echo ""; // OK. -echo ''; // Warning. +echo ''; // Error. -echo ""; // Warning. +echo ""; // Error. ?> Hello -Hey +Hey @@ -71,9 +71,9 @@ echo "<$tag> " , esc_attr( $test ) , "$tag>"; // Error. " . $test . ""; // OK. echo "<{$tag}>" . esc_attr( $tag_content ) . "{$tag}>"; // Error. echo "<$tag" . ' >' . esc_attr( $tag_content ) . "$tag>"; // Error. -echo '