From 2ba1aaf649da4cca2db38a5d9609b2d78ef26762 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Wed, 9 Sep 2026 18:44:26 +0200 Subject: [PATCH] docs(contributor-scan): scope 5.11 to the hook registry, having checked its neighbours "String-named callable" sounds like one gap and is at least two, so the neighbouring forms were measured rather than assumed. All three came back sound, and none of them is what breaks WP Statistics: * taint SURVIVES a string-named callable -- array_map('trim', $_GET['a']) and call_user_func('trim', $_GET['a']) both reach the sink and are entailed, exactly like a plain call; * a sanitizer named by a string IS recognised -- array_map('esc_sql', ...) suppresses, which is the form PMPro actually writes; * the textual sanitizer test does not over-suppress. A query where a SIBLING value is esc_sql-wrapped is still entailed for the unwrapped one, and a decoy 'esc_sql' literal flowing to the same sink does not suppress either, because flow.elements are the nodes on that value's own path. I expected the second and third to be defects and they are not. Recording the negative result so the next reader does not spend the same hour on it. The hook edge is different in kind, which is why it stays its own task: `add_filter` and `apply_filters` are not one expression carrying a callback, they are two statements in two files joined only through a hashtable inside WordPress core -- code that is not even in the scanned tree. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG --- .kiro/specs/contributor-scan/tasks.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.kiro/specs/contributor-scan/tasks.md b/.kiro/specs/contributor-scan/tasks.md index f7c96c1..0f8e2b6 100644 --- a/.kiro/specs/contributor-scan/tasks.md +++ b/.kiro/specs/contributor-scan/tasks.md @@ -600,6 +600,18 @@ source/sink pairing the taint query is told about. - Do NOT approximate it with "any hook may reach any handler". That is a complete graph over the plugin and would entail everything. + - **The neighbouring string-named forms were checked and are sound**, so this task is the hook registry and + nothing else. Measured on probes, 2026-09-09: + - taint SURVIVES a string-named callable -- `array_map('trim', $_GET['a'])` and + `call_user_func('trim', $_GET['a'])` both reach the sink and are entailed, like a plain call; + - a sanitizer named by a string IS recognised -- `array_map('esc_sql', ...)` and + `call_user_func('esc_sql', ...)` both suppress, matching PMPro's own `array_map('esc_sql', $status)`; + - the textual sanitizer test (`taint.sc`: does a path element's code mention the name) does NOT + over-suppress. A query where a SIBLING value is `esc_sql`-wrapped is still entailed for the unwrapped + one, and a decoy `'esc_sql'` literal flowing to the same sink does not suppress either -- because + `flow.elements` are the nodes on that value's own path. + The hook is different in kind: `add_filter` and `apply_filters` are not one expression with a callback in + it, they are two statements in two files joined only through a hashtable in WordPress core. - Observable: CVE-2022-25148 entailed on `wpstatistics`'s vulnerable side and absent on its fixed side -- the pair already pinned, already measured as a double miss, so the number moves or it does not. - _Requirements: 4.4, 8.1, 9.1_