Contrib.social

Add @phpcs:ignore to test cases that unserialize fixtures

Open on Drupal.org →
Created on 25 June 2024, 4 days ago

PHPCS complains about our use of unserialize() being insecure. PHPCS complains about ALL uses of unserialize() because if they process user provided data this can be hazardous.

But the way we use it is in a test case to test serialization of our custom RulesExpressions, which is

  1. Used only when running tests on the testbot, and
  2. Used with fixed and constrained input.

and there is no way this specific usage poses a security vulnerability for any site that has Rules installed.
Additionally, this same usage of unserialize() is done in core too.

Marking these known usages with @phpcs:ignore will prevent the warnings from polluting our test results, and will serve to document the usage as intentional within the code.

📌 Task
Status

Fixed

Version

4.0

Component

Tests

Created by

🇺🇸United States TR Cascadia

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024