Issues (2010)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

wp-includes/class-wp-term.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Taxonomy API: WP_Term class
4
 *
5
 * @package WordPress
6
 * @subpackage Taxonomy
7
 * @since 4.4.0
8
 */
9
10
/**
11
 * Core class used to implement the WP_Term object.
12
 *
13
 * @since 4.4.0
14
 */
15
final class WP_Term {
16
17
	/**
18
	 * Term ID.
19
	 *
20
	 * @since 4.4.0
21
	 * @access public
22
	 * @var int
23
	 */
24
	public $term_id;
25
26
	/**
27
	 * The term's name.
28
	 *
29
	 * @since 4.4.0
30
	 * @access public
31
	 * @var string
32
	 */
33
	public $name = '';
34
35
	/**
36
	 * The term's slug.
37
	 *
38
	 * @since 4.4.0
39
	 * @access public
40
	 * @var string
41
	 */
42
	public $slug = '';
43
44
	/**
45
	 * The term's term_group.
46
	 *
47
	 * @since 4.4.0
48
	 * @access public
49
	 * @var string
50
	 */
51
	public $term_group = '';
52
53
	/**
54
	 * Term Taxonomy ID.
55
	 *
56
	 * @since 4.4.0
57
	 * @access public
58
	 * @var int
59
	 */
60
	public $term_taxonomy_id = 0;
61
62
	/**
63
	 * The term's taxonomy name.
64
	 *
65
	 * @since 4.4.0
66
	 * @access public
67
	 * @var string
68
	 */
69
	public $taxonomy = '';
70
71
	/**
72
	 * The term's description.
73
	 *
74
	 * @since 4.4.0
75
	 * @access public
76
	 * @var string
77
	 */
78
	public $description = '';
79
80
	/**
81
	 * ID of a term's parent term.
82
	 *
83
	 * @since 4.4.0
84
	 * @access public
85
	 * @var int
86
	 */
87
	public $parent = 0;
88
89
	/**
90
	 * Cached object count for this term.
91
	 *
92
	 * @since 4.4.0
93
	 * @access public
94
	 * @var int
95
	 */
96
	public $count = 0;
97
98
	/**
99
	 * Stores the term object's sanitization level.
100
	 *
101
	 * Does not correspond to a database field.
102
	 *
103
	 * @since 4.4.0
104
	 * @access public
105
	 * @var string
106
	 */
107
	public $filter = 'raw';
108
109
	/**
110
	 * Retrieve WP_Term instance.
111
	 *
112
	 * @since 4.4.0
113
	 * @access public
114
	 * @static
115
	 *
116
	 * @global wpdb $wpdb WordPress database abstraction object.
117
	 *
118
	 * @param int    $term_id  Term ID.
119
	 * @param string $taxonomy Optional. Limit matched terms to those matching `$taxonomy`. Only used for
120
	 *                         disambiguating potentially shared terms.
121
	 * @return WP_Term|WP_Error|false Term object, if found. WP_Error if `$term_id` is shared between taxonomies and
122
	 *                                there's insufficient data to distinguish which term is intended.
123
	 *                                False for other failures.
124
	 */
125
	public static function get_instance( $term_id, $taxonomy = null ) {
126
		global $wpdb;
127
128
		$term_id = (int) $term_id;
129
		if ( ! $term_id ) {
130
			return false;
131
		}
132
133
		$_term = wp_cache_get( $term_id, 'terms' );
134
135
		// If there isn't a cached version, hit the database.
136
		if ( ! $_term || ( $taxonomy && $taxonomy !== $_term->taxonomy ) ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $taxonomy of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
137
			// Grab all matching terms, in case any are shared between taxonomies.
138
			$terms = $wpdb->get_results( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE t.term_id = %d", $term_id ) );
139
			if ( ! $terms ) {
140
				return false;
141
			}
142
143
			// If a taxonomy was specified, find a match.
144
			if ( $taxonomy ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $taxonomy of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
145
				foreach ( $terms as $match ) {
146
					if ( $taxonomy === $match->taxonomy ) {
147
						$_term = $match;
148
						break;
149
					}
150
				}
151
152
			// If only one match was found, it's the one we want.
153
			} elseif ( 1 === count( $terms ) ) {
154
				$_term = reset( $terms );
155
156
			// Otherwise, the term must be shared between taxonomies.
157
			} else {
158
				// If the term is shared only with invalid taxonomies, return the one valid term.
159
				foreach ( $terms as $t ) {
160
					if ( ! taxonomy_exists( $t->taxonomy ) ) {
161
						continue;
162
					}
163
164
					// Only hit if we've already identified a term in a valid taxonomy.
165
					if ( $_term ) {
166
						return new WP_Error( 'ambiguous_term_id', __( 'Term ID is shared between multiple taxonomies' ), $term_id );
167
					}
168
169
					$_term = $t;
170
				}
171
			}
172
173
			if ( ! $_term ) {
174
				return false;
175
			}
176
177
			// Don't return terms from invalid taxonomies.
178
			if ( ! taxonomy_exists( $_term->taxonomy ) ) {
179
				return new WP_Error( 'invalid_taxonomy', __( 'Invalid taxonomy.' ) );
180
			}
181
182
			$_term = sanitize_term( $_term, $_term->taxonomy, 'raw' );
183
184
			// Don't cache terms that are shared between taxonomies.
185
			if ( 1 === count( $terms ) ) {
186
				wp_cache_add( $term_id, $_term, 'terms' );
187
			}
188
		}
189
190
		$term_obj = new WP_Term( $_term );
191
		$term_obj->filter( $term_obj->filter );
192
193
		return $term_obj;
194
	}
195
196
	/**
197
	 * Constructor.
198
	 *
199
	 * @since 4.4.0
200
	 * @access public
201
	 *
202
	 * @param WP_Term|object $term Term object.
203
	 */
204
	public function __construct( $term ) {
205
		foreach ( get_object_vars( $term ) as $key => $value ) {
206
			$this->$key = $value;
207
		}
208
	}
209
210
	/**
211
	 * Sanitizes term fields, according to the filter type provided.
212
	 *
213
	 * @since 4.4.0
214
	 * @access public
215
	 *
216
	 * @param string $filter Filter context. Accepts 'edit', 'db', 'display', 'attribute', 'js', 'raw'.
217
	 */
218
	public function filter( $filter ) {
219
		sanitize_term( $this, $this->taxonomy, $filter );
220
	}
221
222
	/**
223
	 * Converts an object to array.
224
	 *
225
	 * @since 4.4.0
226
	 * @access public
227
	 *
228
	 * @return array Object as array.
229
	 */
230
	public function to_array() {
231
		return get_object_vars( $this );
232
	}
233
234
	/**
235
	 * Getter.
236
	 *
237
	 * @since 4.4.0
238
	 * @access public
239
	 *
240
	 * @param string $key Property to get.
241
	 * @return mixed Property value.
242
	 */
243
	public function __get( $key ) {
244
		switch ( $key ) {
245
			case 'data' :
246
				$data = new stdClass();
247
				$columns = array( 'term_id', 'name', 'slug', 'term_group', 'term_taxonomy_id', 'taxonomy', 'description', 'parent', 'count' );
248
				foreach ( $columns as $column ) {
249
					$data->{$column} = isset( $this->{$column} ) ? $this->{$column} : null;
250
				}
251
252
				return sanitize_term( $data, $data->taxonomy, 'raw' );
253
		}
254
	}
255
}
256