Skip to content

Update prefer esc_html_e/esc_attr_e sniff to catch more cases #2906

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Crabcyborg merged 2 commits into from
Jan 29, 2026
Merged

Update prefer esc_html_e/esc_attr_e sniff to catch more cases #2906

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b8ca07c
Update prefer esc html e sniff to catch more cases
Crabcyborg Jan 29, 2026
4516436
Fix another case
Crabcyborg Jan 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion classes/helpers/FrmHtmlHelper.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ public static function echo_unit_input( $args = array() ) {
<input type="hidden" value="<?php echo esc_attr( $hidden_value ); ?>" <?php FrmAppHelper::array_to_html_params( $args['field_attrs'], true ); ?> />
<input <?php FrmAppHelper::array_to_html_params( $input_number_attrs, true ); ?> />
<span class="frm-input-group-suffix">
<select aria-label="<?php echo esc_attr__( 'Select unit', 'formidable' ); ?>" tabindex="0">
<select aria-label="<?php esc_attr_e( 'Select unit', 'formidable' ); ?>" tabindex="0">
<?php
foreach ( $units as $unit ) {
self::echo_dropdown_option( $unit, $unit === ( $selected_unit ?? $args['default_unit'] ), array( 'value' => $unit ) );
Expand Down
6 changes: 3 additions & 3 deletions classes/views/dashboard/templates/notification-banner.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@
<?php FrmAppHelper::icon_by_class( 'frmfont frm_speaker_icon' ); ?>
<span class="frm-vertical-line"></span>
<div>
<h4><?php echo esc_html__( 'Welcome to Formidable Forms', 'formidable' ); ?> 🎉</h4>
<p><?php echo esc_html__( 'Whether you\'re looking to create simple contact forms or complex survey forms, Formidable Forms has you covered.', 'formidable' ); ?></p>
<h4><?php esc_html_e( 'Welcome to Formidable Forms', 'formidable' ); ?> 🎉</h4>
<p><?php esc_html_e( 'Whether you\'re looking to create simple contact forms or complex survey forms, Formidable Forms has you covered.', 'formidable' ); ?></p>
</div>
<div class="frm-shrink-0">
<a target="_blank" href="<?php echo esc_url( FrmAppHelper::admin_upgrade_link( '', 'features' ) ); ?>" class="frm-button-secondary"><?php echo esc_html__( 'Check All Features', 'formidable' ); ?></a>
<a target="_blank" href="<?php echo esc_url( FrmAppHelper::admin_upgrade_link( '', 'features' ) ); ?>" class="frm-button-secondary"><?php esc_html_e( 'Check All Features', 'formidable' ); ?></a>

@coderabbitai coderabbitai Bot Jan 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add rel="noopener noreferrer" for the new-tab link.

Line 17 opens a new tab to an external site; add rel to mitigate reverse‑tabnabbing.

🔧 Suggested change 
-			<a target="_blank" href="<?php echo esc_url( FrmAppHelper::admin_upgrade_link( '', 'features' ) ); ?>" class="frm-button-secondary"><?php esc_html_e( 'Check All Features', 'formidable' ); ?></a>
+			<a target="_blank" rel="noopener noreferrer" href="<?php echo esc_url( FrmAppHelper::admin_upgrade_link( '', 'features' ) ); ?>" class="frm-button-secondary"><?php esc_html_e( 'Check All Features', 'formidable' ); ?></a>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<a target="_blank" href="<?php echo esc_url( FrmAppHelper::admin_upgrade_link( '', 'features' ) ); ?>" class="frm-button-secondary"><?php esc_html_e( 'Check All Features', 'formidable' ); ?></a>
<a target="_blank" rel="noopener noreferrer" href="<?php echo esc_url( FrmAppHelper::admin_upgrade_link( '', 'features' ) ); ?>" class="frm-button-secondary"><?php esc_html_e( 'Check All Features', 'formidable' ); ?></a>
🤖 Prompt for AI Agents 
In `@classes/views/dashboard/templates/notification-banner.php` at line 17, The
anchor that opens a new tab (the link using FrmAppHelper::admin_upgrade_link and
class "frm-button-secondary") should include rel="noopener noreferrer" to
mitigate reverse-tabnabbing; update the <a> tag that currently has
target="_blank" (the one generating the upgrade link) to add rel="noopener
noreferrer" while keeping the existing esc_url() href and esc_html_e() label
intact.

</div>
</div>
</div>
2 changes: 1 addition & 1 deletion classes/views/form-templates/template.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@
esc_html( date_i18n( get_option( 'date_format' ), strtotime( $template['created_at'] ) ) )
);
} else {
echo esc_html__( 'No description', 'formidable' );
esc_html_e( 'No description', 'formidable' );
}
?>
</p>
Expand Down
2 changes: 1 addition & 1 deletion classes/views/shared/errors.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
if ( ! empty( $warnings ) && is_array( $warnings ) ) {
?>
<div class="frm_warning_style inline" role="alert">
<div class="frm_warning_heading"> <?php echo esc_html__( 'Warning:', 'formidable' ); ?></div>
<div class="frm_warning_heading"> <?php esc_html_e( 'Warning:', 'formidable' ); ?></div>
<ul id="frm_warnings">
<?php
foreach ( $warnings as $warning ) {
Expand Down
36 changes: 18 additions & 18 deletions classes/views/styles/components/templates/slider.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,8 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Vertical value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['vertical']['value'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<input aria-label="<?php esc_attr_e( 'Vertical value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['vertical']['value'] ); ?>" />
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['vertical']['unit'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand All @@ -39,8 +39,8 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Top value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['top']['value'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<input aria-label="<?php esc_attr_e( 'Top value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['top']['value'] ); ?>" />
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['top']['unit'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand All @@ -61,8 +61,8 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Bottom value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['bottom']['value'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<input aria-label="<?php esc_attr_e( 'Bottom value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['bottom']['value'] ); ?>" />
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['bottom']['unit'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand All @@ -83,8 +83,8 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Horizontal value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['horizontal']['value'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<input aria-label="<?php esc_attr_e( 'Horizontal value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['horizontal']['value'] ); ?>" />
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['horizontal']['unit'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand All @@ -105,8 +105,8 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Left value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['left']['value'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<input aria-label="<?php esc_attr_e( 'Left value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['left']['value'] ); ?>" />
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['left']['unit'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand All @@ -127,8 +127,8 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Right value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['right']['value'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<input aria-label="<?php esc_attr_e( 'Right value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['right']['value'] ); ?>" />
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['right']['unit'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand Down Expand Up @@ -156,9 +156,9 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Field value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['value_label'] ); ?>" />
<input aria-label="<?php esc_attr_e( 'Field value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['value_label'] ); ?>" />
<input type="hidden" <?php echo esc_attr( $field_name ); ?> value="<?php echo esc_attr( $field_value ); ?>" id="<?php echo esc_attr( $component['id'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['unit_measurement'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand All @@ -181,8 +181,8 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Field value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['value_label'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<input aria-label="<?php esc_attr_e( 'Field value', 'formidable' ); ?>" type="text" value="<?php echo esc_attr( $component['value_label'] ); ?>" />
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['unit_measurement'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand All @@ -208,9 +208,9 @@
</span>
</div>
<div class="frm-slider-value">
<input aria-label="<?php echo esc_attr__( 'Field value', 'formidable' ); ?>" type="text" value="<?php echo empty( $component['unit_measurement'] ) ? esc_attr( $field['value'] ) : (int) $field['value']; ?>" />
<input aria-label="<?php esc_attr_e( 'Field value', 'formidable' ); ?>" type="text" value="<?php echo empty( $component['unit_measurement'] ) ? esc_attr( $field['value'] ) : (int) $field['value']; ?>" />
<input type="hidden" name="<?php echo esc_attr( $field['name'] ); ?>" value="<?php echo esc_attr( $field['value'] ); ?>" id="<?php echo esc_attr( $field['id'] ); ?>" />
<select aria-label="<?php echo esc_attr__( 'Value unit', 'formidable' ); ?>">
<select aria-label="<?php esc_attr_e( 'Value unit', 'formidable' ); ?>">
<?php foreach ( $component['units'] as $unit ) : ?>
<option <?php selected( $component['unit_measurement'], $unit ); ?> value="<?php echo esc_attr( $unit ); ?>"><?php echo esc_html( $unit ); ?></option>
<?php endforeach; ?>
Expand Down
92 changes: 84 additions & 8 deletions phpcs-sniffs/Formidable/Sniffs/CodeAnalysis/PreferEscHtmlESniff.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@
* - echo esc_attr( __( ... ) ) -> esc_attr_e( ... )
* - echo esc_html( _x( ... ) ) -> esc_html_x( ... )
* - echo esc_attr( _x( ... ) ) -> esc_attr_x( ... )
* - echo esc_html__( ... ) -> esc_html_e( ... )
* - echo esc_attr__( ... ) -> esc_attr_e( ... )
*/
class PreferEscHtmlESniff implements Sniff {

Expand All @@ -37,6 +39,16 @@ class PreferEscHtmlESniff implements Sniff {
),
);

/**
* Mapping of already combined functions that should drop echo entirely.
*
* @var array
*/
private $directReplacements = array(
'esc_html__' => 'esc_html_e',
'esc_attr__' => 'esc_attr_e',
);

/**
* Returns an array of tokens this test wants to listen for.
*
Expand Down Expand Up @@ -71,6 +83,11 @@ public function process( File $phpcsFile, $stackPtr ) {

$escapeFunc = $tokens[ $nextToken ]['content'];

if ( isset( $this->directReplacements[ $escapeFunc ] ) ) {
$this->processDirectCombinedFunction( $phpcsFile, $stackPtr, $nextToken, $escapeFunc );
return;
}

if ( ! isset( $this->replacements[ $escapeFunc ] ) ) {
return;
}
Expand Down Expand Up @@ -144,17 +161,76 @@ public function process( File $phpcsFile, $stackPtr ) {
);

if ( true === $fix ) {
$phpcsFile->fixer->beginChangeset();
$this->replaceEchoWithCombinedFunction( $phpcsFile, $stackPtr, $semicolon, $replacementFunc, $translateArgs );
}
}

/**
* Handle echo statements that already use combined translation helpers.
*
* @param File $phpcsFile The file being scanned.
* @param int $stackPtr Pointer to the echo token.
* @param int $functionPointer Pointer to the combined function token.
* @param string $functionName The function currently in use (e.g. esc_html__).
*
* @return void
*/
private function processDirectCombinedFunction( File $phpcsFile, $stackPtr, $functionPointer, $functionName ) {
$tokens = $phpcsFile->getTokens();

$openParen = $phpcsFile->findNext( T_WHITESPACE, $functionPointer + 1, null, true );

if ( false === $openParen || $tokens[ $openParen ]['code'] !== T_OPEN_PARENTHESIS ) {
return;
}

if ( ! isset( $tokens[ $openParen ]['parenthesis_closer'] ) ) {
return;
}

$closeParen = $tokens[ $openParen ]['parenthesis_closer'];

$semicolon = $phpcsFile->findNext( T_WHITESPACE, $closeParen + 1, null, true );

if ( false === $semicolon || $tokens[ $semicolon ]['code'] !== T_SEMICOLON ) {
return;
}

$args = $phpcsFile->getTokensAsString( $openParen + 1, $closeParen - $openParen - 1 );
$replacementFunc = $this->directReplacements[ $functionName ];

$fix = $phpcsFile->addFixableError(
'Use %s() instead of echo %s().',
$stackPtr,
'PreferCombinedFunctionDirect',
array( $replacementFunc, $functionName )
);

// Remove everything from echo to the semicolon.
for ( $i = $stackPtr; $i <= $semicolon; $i++ ) {
$phpcsFile->fixer->replaceToken( $i, '' );
}
if ( true === $fix ) {
$this->replaceEchoWithCombinedFunction( $phpcsFile, $stackPtr, $semicolon, $replacementFunc, $args );
}
}

// Add the new combined function call.
$phpcsFile->fixer->addContent( $stackPtr, $replacementFunc . '( ' . trim( $translateArgs ) . ' );' );
/**
* Replace an echo statement with the combined helper.
*
* @param File $phpcsFile The file being scanned.
* @param int $stackPtr Pointer to the echo token.
* @param int $semicolonPtr Pointer to the semicolon.
* @param string $replacement Function name to use.
* @param string $argumentString Function arguments as a string.
*
* @return void
*/
private function replaceEchoWithCombinedFunction( File $phpcsFile, $stackPtr, $semicolonPtr, $replacement, $argumentString ) {
$phpcsFile->fixer->beginChangeset();

$phpcsFile->fixer->endChangeset();
for ( $i = $stackPtr; $i <= $semicolonPtr; $i++ ) {
$phpcsFile->fixer->replaceToken( $i, '' );
}

$phpcsFile->fixer->addContent( $stackPtr, $replacement . '( ' . trim( $argumentString ) . ' );' );

$phpcsFile->fixer->endChangeset();
}
}
2 changes: 1 addition & 1 deletion stripe/views/payments/show.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@
<?php endif; ?>

<div class="misc-pub-section">
<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'frm_action', 'destroy' ) ) ); ?>" data-frmverify="<?php echo esc_attr__( 'Permanently delete this payment?', 'formidable' ); ?>" data-frmverify-btn="frm-button-red" title="<?php esc_attr_e( 'Delete', 'formidable' ); ?>">
<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'frm_action', 'destroy' ) ) ); ?>" data-frmverify="<?php esc_attr_e( 'Permanently delete this payment?', 'formidable' ); ?>" data-frmverify-btn="frm-button-red" title="<?php esc_attr_e( 'Delete', 'formidable' ); ?>">
<?php FrmAppHelper::icon_by_class( 'frmfont frm_delete_icon' ); ?>
<span class="frm_link_label">
<?php esc_html_e( 'Delete Payment', 'formidable' ); ?>
Expand Down
2 changes: 1 addition & 1 deletion stripe/views/subscriptions/show.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@
</div>

<div id="misc-pub-section">
<a class="submitdelete deletion" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'frm_action', 'destroy' ) ) ); ?>" data-frmverify="<?php echo esc_attr__( 'Permanently delete this subscription?', 'formidable' ); ?>" data-frmverify-btn="frm-button-red" title="<?php esc_attr_e( 'Delete', 'formidable' ); ?>">
<a class="submitdelete deletion" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'frm_action', 'destroy' ) ) ); ?>" data-frmverify="<?php esc_attr_e( 'Permanently delete this subscription?', 'formidable' ); ?>" data-frmverify-btn="frm-button-red" title="<?php esc_attr_e( 'Delete', 'formidable' ); ?>">
<?php FrmAppHelper::icon_by_class( 'frmfont frm_delete_icon' ); ?>
<span class="frm_link_label">
<?php esc_html_e( 'Delete Subscription', 'formidable' ); ?>
Expand Down