Skip to content

Unescaped translations are not flagged by 'HM' standards #273

Open
@sambulance

Description

@sambulance

Unescaped output from WordPress translation functions is not being flagged by the full HM standards checks.

The HM-Minimum standard allows the use of unescaped translation functions (see HM-Minimum/ruleset.xml#L57-L66). The minimum standards are then imported into HM standards (HM/ruleset.xml#L12-L13), but there are no other rules in the HM standard that check the output of these functions is escaped.

The following code should pass HM-Minimum, but fail HM. Currently, it passes both.

echo __( 'This should error', 'err' );

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions