Use FILTER_SANITIZE_EMAIL filter to sanitize email input (#8957)

Automattic · Jun 14, 2024 · 0948bf9 · 0948bf9
1 parent 13ea0cf
commit 0948bf9
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/changelog/update-use-filter-sanitize-email-to-sanitize-email-input b/changelog/update-use-filter-sanitize-email-to-sanitize-email-input
@@ -0,0 +1,4 @@
+Significance: patch
+Type: update
+
+Use FILTER_SANITIZE_EMAIL to sanitize email input
diff --git a/includes/express-checkout/class-wc-payments-express-checkout-button-display-handler.php b/includes/express-checkout/class-wc-payments-express-checkout-button-display-handler.php
@@ -202,9 +202,7 @@ function ( $js_config ) use ( $order ) {
 						$session_email = is_array( $customer ) && isset( $customer['email'] ) ? $customer['email'] : '';
 					}
 
-					// Silence the filter_input warning because we are sanitizing the input with sanitize_email().
-					// nosemgrep: audit.php.lang.misc.filter-input-no-filter.
-					$user_email = isset( $_POST['email'] ) ? sanitize_email( wp_unslash( filter_input( INPUT_POST, 'email' ) ) ) : $session_email;
+					$user_email = isset( $_POST['email'] ) ? sanitize_email( wp_unslash( filter_input( INPUT_POST, 'email', FILTER_SANITIZE_EMAIL ) ) ) : $session_email;
 
 					$js_config['order_id'] = $order->get_id();
 					// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated