PurpleTurtleCreative / completionist

Asana integration plugin for WordPress.
https://purpleturtlecreative.com/completionist/
GNU General Public License v3.0
1 stars 0 forks source link

Sanitize HTTP_REFERER usage #202

Closed MichelleBlanchette closed 8 months ago

MichelleBlanchette commented 8 months ago

This is a final change request from the WordPress Plugin Review Team:

Hi, thanks for the changes and helpful explanations.

Just a final issue that won't prevent approval at this time, please fix it when able.

Data Must be Sanitized, Escaped, and Validated

completionist/src/includes/class-asana-interface.php:1832 $referrer = wp_unslash( $_SERVER['HTTP_REFERER'] );

(Although it is a $server variable, the http_referer it can be manipulated by the browser)

Regards.

MichelleBlanchette commented 8 months ago

I just investigated this and believe it's a non-issue because I esc_url_raw() wherever it ends up actually being used.