Merge pull request #29 from Automattic/workflows

Run phpcs on PRs

.github/workflows/pull-request.yml

@@ -0,0 +1,18 @@
+name: PR checks
+
+on:
+  pull_request:
+    types: [ opened, synchronize ]
+
+jobs:
+  lint-plugin:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Install composer dependencies
+        run: composer install
+
+      - name: Run phpcs
+        run: ./vendor/bin/phpcs

src/Http/Handlers/AuthorizeHandler.php

@@ -1,5 +1,7 @@
 <?php
 
+// phpcs:disable WordPress.Security.NonceVerification.Missing
+
 namespace OpenIDConnectServer\Http\Handlers;
 
 use OAuth2\Request;

src/Http/Router.php

@@ -56,14 +56,14 @@ function () use ( $route, $methods ) {
 		);
 	}
 
-	private function get_current_route() {
+	private function get_current_route(): string {
 		$wp_url        = get_site_url();
-		$installed_dir = parse_url( $wp_url, PHP_URL_PATH );
+		$installed_dir = wp_parse_url( $wp_url, PHP_URL_PATH );
 
-		// requested uri relative to WP install
-		$request_uri = str_replace( $installed_dir, '', $_SERVER['REQUEST_URI'] );
+		// Requested URI relative to WP install.
+		$uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
+		$uri = str_replace( $installed_dir, '', $uri );
 
-		$uri   = sanitize_text_field( wp_unslash( $request_uri ) );
 		$route = strtok( $uri, '?' );
 
 		return trim( $route, '/' );

src/Storage/UserClaimsStorage.php

@@ -1,5 +1,7 @@
 <?php
 
+//phpcs:disable WordPress.Security.NonceVerification.Recommended
+
 namespace OpenIDConnectServer\Storage;
 
 use OAuth2\OpenID\Storage\UserClaimsInterface;