New test proposal: CORS policy check pattern about phpcs-security-audit HOT 2 CLOSED

Hey,

this example look like it's from the Slim Framework, which is unsupported.

As for the suggestion, PHP CodeSniffer works with tokens and not lines, so it would have to be two T_CONSTANT_ENCAPSED_STRING or T_DOUBLE_QUOTED_STRING ($stringTokens in phpcs actually) token next together (in phpcs . That would actually cover the case of Slim and Symfony There's also as one string as header('Access-Control-Allow-Origin: *); is normal PHP.

Working on implementing something quick..

Thanks for the suggestion!

from phpcs-security-audit.

Added as a Misc one (and found that I wasn't loading the one rule in Misc):

<!-- Misc -->
<rule ref="Security.Misc.BadCorsHeader"/>
<rule ref="Security.Misc.IncludeMismatch"/>

from phpcs-security-audit.