A Problem
There are times when it’s difficult for a plugin developer to know the most secure way to implement something (e.g., preparing a SQL query with conditional clauses), and it can be easy to overlook bugs and bad practices when there are thousands of lines of code.
That creates bad experiences for users when something breaks or their site is hacked.
A Potential Solution
Static code analysis could help to catch bugs, and inform developers how to fix them. It could also reduce the amount of time the Plugin team spends doing manual reviews.
The Coding Standards project has already built an extensive set of PHPCS sniffs, and the Meta team has prototyped a custom PHPCS standard for the Plugin Repository.
Would something like that be useful? If so, what exactly should it check for?
Feedback
- At a high level, what concerns need to be addressed? e.g., security, backwards/forwards-compatibility, best practices?
- At a lower level, what specific things should be reported? e.g., escaped database queries & HTML output, using Core APIs where available, avoiding deprecated functions?
- What existing sniffs should be included from WPCS?
- What new sniffs need to be developed?
- What should be treated as an error, and what should just be a recommendation?
- What are the current gaps in documentation? e.g., piecing together complex MySQL queries with multiple variables. We’ll need good documentation to help devs understand a problem in their code, and fix it the right way.
- What are the current gaps in functionality that Core provides to plugins? e.g., escaping table and column names, native MySQL prepared statements, an HTML templating language. It’ll be easier for plugins to meet the standard if they don’t have to create their own implementations of common functionality.
- What metrics should we track to determine if code quality is improving enough?
- What metrics should we track to determine if we’re saving the Plugin Team enough time?
If you’re interested in similar conversations, check out the #core-coding-standards channel in our Slack workspace.
+make.wordpress.org/plugins/ +make.wordpress.org/docs/ +make.wordpress.org/core/