<?xml version="1.0"?>
<ruleset name="Woo Marketplace PHPCS Security Checks">
    <description>Woo Marketplace PHPCS Security Checks.</description>

    <arg value="sp"/>
    <arg name="colors"/>
    <arg name="extensions" value="php"/>
    <arg name="parallel" value="8"/>
    
    <exclude-pattern>tests/*</exclude-pattern>
    <exclude-pattern>vendor/*</exclude-pattern>
    <exclude-pattern>vendor-prefixed/*</exclude-pattern>


    <rule ref="WordPress.Security.EscapeOutput">
        <properties>
            <property name="customEscapingFunctions" type="array" value="WC_Payments_Utils,esc_interpolated_html,wc_help_tip,wc_sanitize_tooltip,wc_selected,wc_kses_notice,wc_esc_json,wc_query_string_form_fields,wc_make_phone_clickable" />
        </properties>
    </rule>
    
    <!-- Lack of nonces will be added at a later point to minimize noise. -->
    <rule ref="WordPress.Security.NonceVerification">
        <severity>0</severity>
    </rule>
    
    <!-- Do not flag missing "wp_unslash()" calls to globals such as $_POST, and $_GET, etc. -->
    <rule ref="WordPress.Security.ValidatedSanitizedInput.MissingUnslash">
        <severity>0</severity>
    </rule>
    
    <!-- Do not flag missing checks of "isset" on $_POST, $_GET, etc. -->
    <rule ref="WordPress.Security.ValidatedSanitizedInput.InputNotValidated">
        <severity>0</severity>
    </rule>
    
    <!-- Do not flag usage of deprecated "// WPCS: XSS ok." -->
    <rule ref="WordPress.Security.EscapeOutput.DeprecatedWhitelistCommentFound">
        <severity>0</severity>
    </rule>
    
    <!-- Warn about usage of potentially dangerous functions. -->
    <rule ref="Generic.PHP.ForbiddenFunctions">
      <properties>
        <property name="error" value="false" />
        <property name="forbiddenFunctions" type="array" value="wp_set_auth_cookie=>null,wp_set_current_user=>null"/>
      </properties>
    </rule>
    
    <rule ref="WordPress.Security.PluginMenuSlug"/>
    
    <!-- When we disable "InputNotValidated", "InputNotSanitized" also gets disabled, and this is not what we want. -->
    <rule ref="WordPress.Security.ValidatedSanitizedInput.InputNotSanitized">
        <severity>5</severity>
    </rule>
    
    <rule ref="WordPress.Security.ValidatedSanitizedInput">    
        <properties>
            <property name="customSanitizingFunctions" type="array" value="wc_booking_sanitize_time,wc_clean,wc_sanitize_tooltip,wc_format_decimal,wc_stock_amount,wc_sanitize_permalink,wc_sanitize_textarea" />
            <property name="customUnslashingSanitizingFunctions" type="array" value="stripslashes"/>
        </properties>
    </rule>
</ruleset>