Merge pull request Automattic#83 from hibernation/issue-72

Add $_SERVER check - close issue Automattic#72
hibernation · Mar 13, 2014 · 9ed5d16 · 9ed5d16
2 parents 8f96233 + 50dcd87
commit 9ed5d16
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/vip-scanner/checks/VIPRestrictedPatternsCheck.php b/vip-scanner/checks/VIPRestrictedPatternsCheck.php
@@ -17,6 +17,7 @@ function check( $files ) {
 			"/(echo|print|\<\?\=)+.+(\\\$GLOBALS|\\\$_SERVER|\\\$_GET|\\\$_REQUEST|\\\$_POST)+/msiU" => array( "level" => "Warning", "note" => "Possible output of restricted variables" ),
 			"/(echo|print|\<\?\=)+.+(get_search_query)+/msiU" => array( "level" => "Warning", "note" => "Output of search query" ),
 			"/(\\\$GLOBALS|\\\$_SERVER|\\\$_GET|\\\$_REQUEST|\\\$_POST)+/msiU" => array( "level" => "Note", "note" => "Working with superglobals" ),
+			"/(\\\$_SERVER\[(?!('|\"REQUEST_URI|SCRIPT_FILENAME|HTTP_HOST'|\"))([^]]+|)\])+/msiU" => array( "level" => "Blocker", "note" => 'Non whitelisted $_SERVER superglobals found in this file' ),
 		);
 
 		foreach ( $this->filter_files( $files, 'php' ) as $file_path => $file_content ) {