{"action":"closed","number":342,"pull_request":{"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls/342","id":32172013,"html_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/342","diff_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/342.diff","patch_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/342.patch","issue_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/342","number":342,"state":"closed","locked":false,"title":"XSS sniff: better handling for sprintf()","user":{"login":"JDGrimes","id":4005415,"avatar_url":"https://avatars.githubusercontent.com/u/4005415?v=3","gravatar_id":"","url":"https://api.github.com/users/JDGrimes","html_url":"https://github.com/JDGrimes","followers_url":"https://api.github.com/users/JDGrimes/followers","following_url":"https://api.github.com/users/JDGrimes/following{/other_user}","gists_url":"https://api.github.com/users/JDGrimes/gists{/gist_id}","starred_url":"https://api.github.com/users/JDGrimes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JDGrimes/subscriptions","organizations_url":"https://api.github.com/users/JDGrimes/orgs","repos_url":"https://api.github.com/users/JDGrimes/repos","events_url":"https://api.github.com/users/JDGrimes/events{/privacy}","received_events_url":"https://api.github.com/users/JDGrimes/received_events","type":"User","site_admin":false},"body":"`sprintf()` is often used for formatting translation strings, and it is common practice to escape the individual parameters passed to it as needed instead of escaping the entire result. This is especially true when the string being formatted contains HTML, which makes escaping the full result more difficult.\n\nThis provides better handling for `sprintf()` by ignoring the function itself and only requiring escaping for its parameters.\n\nNote that `sprintf()` also provides limited sanitization for the values passed to it when number formatting is performed (i.e., for all but the `%s` placeholder). I had originally wanted to take this into account, but it proved too complex. So all parameters passed to `sprintf()` need to be escaped, even when they will be formatted using, e.g., `%d`, and are really safe.\n\n#reviewmerge\n\nFixes #212","created_at":"2015-03-28T21:54:36Z","updated_at":"2015-03-30T15:05:33Z","closed_at":"2015-03-30T15:05:33Z","merged_at":"2015-03-30T15:05:33Z","merge_commit_sha":"9a238fac6f620b4449456f78557afe5853b46d39","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls/342/commits","review_comments_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls/342/comments","review_comment_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls/comments{/number}","comments_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/342/comments","statuses_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/statuses/1b2819181c8761e29e9346bdccb952daf8c9ac2d","head":{"label":"WordPress-Coding-Standards:issue/212","ref":"issue/212","sha":"1b2819181c8761e29e9346bdccb952daf8c9ac2d","user":{"login":"WordPress-Coding-Standards","id":3841697,"avatar_url":"https://avatars.githubusercontent.com/u/3841697?v=3","gravatar_id":"","url":"https://api.github.com/users/WordPress-Coding-Standards","html_url":"https://github.com/WordPress-Coding-Standards","followers_url":"https://api.github.com/users/WordPress-Coding-Standards/followers","following_url":"https://api.github.com/users/WordPress-Coding-Standards/following{/other_user}","gists_url":"https://api.github.com/users/WordPress-Coding-Standards/gists{/gist_id}","starred_url":"https://api.github.com/users/WordPress-Coding-Standards/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WordPress-Coding-Standards/subscriptions","organizations_url":"https://api.github.com/users/WordPress-Coding-Standards/orgs","repos_url":"https://api.github.com/users/WordPress-Coding-Standards/repos","events_url":"https://api.github.com/users/WordPress-Coding-Standards/events{/privacy}","received_events_url":"https://api.github.com/users/WordPress-Coding-Standards/received_events","type":"Organization","site_admin":false},"repo":{"id":1691187,"name":"WordPress-Coding-Standards","full_name":"WordPress-Coding-Standards/WordPress-Coding-Standards","owner":{"login":"WordPress-Coding-Standards","id":3841697,"avatar_url":"https://avatars.githubusercontent.com/u/3841697?v=3","gravatar_id":"","url":"https://api.github.com/users/WordPress-Coding-Standards","html_url":"https://github.com/WordPress-Coding-Standards","followers_url":"https://api.github.com/users/WordPress-Coding-Standards/followers","following_url":"https://api.github.com/users/WordPress-Coding-Standards/following{/other_user}","gists_url":"https://api.github.com/users/WordPress-Coding-Standards/gists{/gist_id}","starred_url":"https://api.github.com/users/WordPress-Coding-Standards/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WordPress-Coding-Standards/subscriptions","organizations_url":"https://api.github.com/users/WordPress-Coding-Standards/orgs","repos_url":"https://api.github.com/users/WordPress-Coding-Standards/repos","events_url":"https://api.github.com/users/WordPress-Coding-Standards/events{/privacy}","received_events_url":"https://api.github.com/users/WordPress-Coding-Standards/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards","description":"PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions","fork":false,"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards","forks_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/forks","keys_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/keys{/key_id}","collaborators_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/teams","hooks_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/hooks","issue_events_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/events{/number}","events_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/events","assignees_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/assignees{/user}","branches_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/branches{/branch}","tags_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/tags","blobs_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/refs{/sha}","trees_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/trees{/sha}","statuses_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/statuses/{sha}","languages_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/languages","stargazers_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/stargazers","contributors_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/contributors","subscribers_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/subscribers","subscription_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/subscription","commits_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/commits{/sha}","git_commits_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/commits{/sha}","comments_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/comments{/number}","issue_comment_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/comments{/number}","contents_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/contents/{+path}","compare_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/compare/{base}...{head}","merges_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/merges","archive_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/downloads","issues_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues{/number}","pulls_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls{/number}","milestones_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/milestones{/number}","notifications_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/labels{/name}","releases_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/releases{/id}","created_at":"2011-05-02T12:49:18Z","updated_at":"2015-03-30T10:33:34Z","pushed_at":"2015-03-30T15:05:33Z","git_url":"git://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards.git","ssh_url":"git@github.com:WordPress-Coding-Standards/WordPress-Coding-Standards.git","clone_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards.git","svn_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards","homepage":"","size":2964,"stargazers_count":343,"watchers_count":343,"language":"PHP","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":85,"mirror_url":null,"open_issues_count":62,"forks":85,"open_issues":62,"watchers":343,"default_branch":"develop"}},"base":{"label":"WordPress-Coding-Standards:develop","ref":"develop","sha":"0c213f9d4a8b1a103f7f9c43905ef3757dc3a74a","user":{"login":"WordPress-Coding-Standards","id":3841697,"avatar_url":"https://avatars.githubusercontent.com/u/3841697?v=3","gravatar_id":"","url":"https://api.github.com/users/WordPress-Coding-Standards","html_url":"https://github.com/WordPress-Coding-Standards","followers_url":"https://api.github.com/users/WordPress-Coding-Standards/followers","following_url":"https://api.github.com/users/WordPress-Coding-Standards/following{/other_user}","gists_url":"https://api.github.com/users/WordPress-Coding-Standards/gists{/gist_id}","starred_url":"https://api.github.com/users/WordPress-Coding-Standards/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WordPress-Coding-Standards/subscriptions","organizations_url":"https://api.github.com/users/WordPress-Coding-Standards/orgs","repos_url":"https://api.github.com/users/WordPress-Coding-Standards/repos","events_url":"https://api.github.com/users/WordPress-Coding-Standards/events{/privacy}","received_events_url":"https://api.github.com/users/WordPress-Coding-Standards/received_events","type":"Organization","site_admin":false},"repo":{"id":1691187,"name":"WordPress-Coding-Standards","full_name":"WordPress-Coding-Standards/WordPress-Coding-Standards","owner":{"login":"WordPress-Coding-Standards","id":3841697,"avatar_url":"https://avatars.githubusercontent.com/u/3841697?v=3","gravatar_id":"","url":"https://api.github.com/users/WordPress-Coding-Standards","html_url":"https://github.com/WordPress-Coding-Standards","followers_url":"https://api.github.com/users/WordPress-Coding-Standards/followers","following_url":"https://api.github.com/users/WordPress-Coding-Standards/following{/other_user}","gists_url":"https://api.github.com/users/WordPress-Coding-Standards/gists{/gist_id}","starred_url":"https://api.github.com/users/WordPress-Coding-Standards/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WordPress-Coding-Standards/subscriptions","organizations_url":"https://api.github.com/users/WordPress-Coding-Standards/orgs","repos_url":"https://api.github.com/users/WordPress-Coding-Standards/repos","events_url":"https://api.github.com/users/WordPress-Coding-Standards/events{/privacy}","received_events_url":"https://api.github.com/users/WordPress-Coding-Standards/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards","description":"PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions","fork":false,"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards","forks_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/forks","keys_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/keys{/key_id}","collaborators_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/teams","hooks_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/hooks","issue_events_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/events{/number}","events_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/events","assignees_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/assignees{/user}","branches_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/branches{/branch}","tags_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/tags","blobs_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/refs{/sha}","trees_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/trees{/sha}","statuses_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/statuses/{sha}","languages_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/languages","stargazers_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/stargazers","contributors_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/contributors","subscribers_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/subscribers","subscription_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/subscription","commits_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/commits{/sha}","git_commits_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/git/commits{/sha}","comments_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/comments{/number}","issue_comment_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/comments{/number}","contents_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/contents/{+path}","compare_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/compare/{base}...{head}","merges_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/merges","archive_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/downloads","issues_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues{/number}","pulls_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls{/number}","milestones_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/milestones{/number}","notifications_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/labels{/name}","releases_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/releases{/id}","created_at":"2011-05-02T12:49:18Z","updated_at":"2015-03-30T10:33:34Z","pushed_at":"2015-03-30T15:05:33Z","git_url":"git://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards.git","ssh_url":"git@github.com:WordPress-Coding-Standards/WordPress-Coding-Standards.git","clone_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards.git","svn_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards","homepage":"","size":2964,"stargazers_count":343,"watchers_count":343,"language":"PHP","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":85,"mirror_url":null,"open_issues_count":62,"forks":85,"open_issues":62,"watchers":343,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls/342"},"html":{"href":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/342"},"issue":{"href":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/342"},"comments":{"href":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/342/comments"},"review_comments":{"href":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls/342/comments"},"review_comment":{"href":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/pulls/342/commits"},"statuses":{"href":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/statuses/1b2819181c8761e29e9346bdccb952daf8c9ac2d"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"JDGrimes","id":4005415,"avatar_url":"https://avatars.githubusercontent.com/u/4005415?v=3","gravatar_id":"","url":"https://api.github.com/users/JDGrimes","html_url":"https://github.com/JDGrimes","followers_url":"https://api.github.com/users/JDGrimes/followers","following_url":"https://api.github.com/users/JDGrimes/following{/other_user}","gists_url":"https://api.github.com/users/JDGrimes/gists{/gist_id}","starred_url":"https://api.github.com/users/JDGrimes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JDGrimes/subscriptions","organizations_url":"https://api.github.com/users/JDGrimes/orgs","repos_url":"https://api.github.com/users/JDGrimes/repos","events_url":"https://api.github.com/users/JDGrimes/events{/privacy}","received_events_url":"https://api.github.com/users/JDGrimes/received_events","type":"User","site_admin":false},"comments":9,"review_comments":1,"commits":6,"additions":57,"deletions":2,"changed_files":3}}