PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic

[alanef]

Warns about sanitization on callbacks using array( $this, 'cb_function') when $this should not be sanitized

[swissspidy]

I think the sniff is working as intended. It's a static check so it doesn't really know what the function is, hence it emits a warning telling you to ensure proper sanitization.

See

plugin-check/phpcs-sniffs/PluginCheck/Sniffs/CodeAnalysis/SettingSanitizationSniff.php

Lines 89 to 100 in c334a5f

	if ( false !== $next_token ) {
	$next_type = $this->tokens[ $next_token ]['type'];
	if ( in_array( $next_type, array( 'T_ARRAY', 'T_OPEN_SHORT_ARRAY', 'T_VARIABLE', 'T_CALLABLE' ), true ) ) {
	$this->phpcsFile->addWarning(
	'Dynamic argument passed in third parameter of %s(). Please ensure proper sanitization.',
	$stackPtr,
	$error_code . 'Dynamic',
	array( $matched_content )
	);
	}
	}

@ernilambar please correct me if I'm wrong

[alanef]

I get it is a warning. Maybe I dont undersatnd the wording. "Please ensure proper sanitization" of what ?

I'm not sure why the third param need sanitization in anycase?

https://developer.wordpress.org/reference/functions/register_setting/

the warning happens in all combinations i looked at

Maybe the warning has to be clearer? Otherwise it is just noise ( to me )

register_setting(
			$this->option_group,                         /* Option Group */
			"{$this->option_group}-reset",
			'function'
		);

register_setting(
			$this->option_group,                         /* Option Group */
			"{$this->option_group}-reset",
			array(
				'sanitize_callback' => 'reset_sanitize',
				'default' => NULL,
			) /* Sanitize Callback */
		);

register_setting(
			$this->option_group,                         /* Option Group */
			"{$this->option_group}-reset",
			array(
				'sanitize_callback' => array( $this, 'reset_sanitize' ),
				'default' => NULL,
			) /* Sanitize Callback */
		);

[ernilambar]

The third parameter of register_setting() accepts various data types, including strings, callable functions, anonymous functions, and other dynamic arguments. Static analysis via PHPCS cannot reliably determine the parameter's type. Sanitization is recommended before storing this data in the database to ensure data integrity and security. Suggestions for improved wording are welcome.