diff --git a/changelog/update-use-filter-sanitize-email-to-sanitize-email-input b/changelog/update-use-filter-sanitize-email-to-sanitize-email-input new file mode 100644 index 00000000000..0e1c685b676 --- /dev/null +++ b/changelog/update-use-filter-sanitize-email-to-sanitize-email-input @@ -0,0 +1,4 @@ +Significance: patch +Type: update + +Use FILTER_SANITIZE_EMAIL to sanitize email input diff --git a/includes/express-checkout/class-wc-payments-express-checkout-button-display-handler.php b/includes/express-checkout/class-wc-payments-express-checkout-button-display-handler.php index ab132195f81..66c203b818f 100644 --- a/includes/express-checkout/class-wc-payments-express-checkout-button-display-handler.php +++ b/includes/express-checkout/class-wc-payments-express-checkout-button-display-handler.php @@ -202,9 +202,7 @@ function ( $js_config ) use ( $order ) { $session_email = is_array( $customer ) && isset( $customer['email'] ) ? $customer['email'] : ''; } - // Silence the filter_input warning because we are sanitizing the input with sanitize_email(). - // nosemgrep: audit.php.lang.misc.filter-input-no-filter. - $user_email = isset( $_POST['email'] ) ? sanitize_email( wp_unslash( filter_input( INPUT_POST, 'email' ) ) ) : $session_email; + $user_email = isset( $_POST['email'] ) ? sanitize_email( wp_unslash( filter_input( INPUT_POST, 'email', FILTER_SANITIZE_EMAIL ) ) ) : $session_email; $js_config['order_id'] = $order->get_id(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated