PCP notes (accepted false positives)

The following are known Plugin Check (PCP) false positives, documented rather than suppressed with phpcs:ignore (except where a genuine fix using $wpdb->prepare()’s %i identifier placeholder was possible instead — see 1.0.11 changelog).

WordPress.DB.DirectDatabaseQuery / NoCaching (class-lh-polls-db.php)

All queries operate on custom tables (lh_poll_options, lh_poll_votes) with no WP API wrapper — direct $wpdb queries are correct. The class implements its own full transient caching layer via flush_poll_cache(); PCP cannot statically trace this.

WordPress.Security.EscapeOutput.OutputNotEscaped on $avatar (class-lh-polls-votes-metabox.php)

$avatar is the return value of bp_core_fetch_avatar() with ‘html’ => true — the BuddyPress equivalent of get_avatar(), returning trusted internally-generated HTML that cannot be passed through an escaping function without corruption.

WordPress.Security.NonceVerification in validate_poll_options (class-lh-polls-post-types.php)

Fires via wp_insert_post_data before the post is saved. The nonce is verified in each metabox’s own save() method (via the shared should_save_poll_meta() guard), processing the same POST request — PCP cannot trace nonce verification across separate hook callbacks.

WordPress.Security.NonceVerification.Recommended on feedback $_GET params

lh_poll_msg and lh_poll_id query parameters are set by the plugin itself as part of a post-vote redirect, used only to display a read-only feedback message — no state change occurs. A nonce on a redirect parameter would expire immediately.

WordPress.Security.EscapeOutput.OutputNotEscaped on $this->render_poll_markup(…) / poll_js_tag() (class-lh-polls-embed.php)

Both methods build their return values entirely from esc_html(), esc_attr(), esc_url(), esc_textarea(), wp_nonce_field(), and wp_json_encode() with JSON_HEX_TAG/JSON_HEX_AMP — every dynamic value is escaped at the point of output within those methods. PCP cannot trace escaping through a method’s internal implementation.

WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet / NonEnqueuedScript (class-lh-polls-embed.php, serve_poll_document)

The embed view (is_embed()) is a complete self-contained HTML document output directly via template_redirect + exit — it never calls wp_head()/wp_footer(), so wp_enqueue_style()/wp_enqueue_script() would never print. This is the intentional zero-theme-dependency design for the embed view. The standalone singular view (filter_the_content) does use wp_enqueue_style() correctly.

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized on $_GET[‘redirect’]

Passed through esc_url_raw( urldecode( wp_unslash( $_GET[‘redirect’] ) ) ). PCP cannot trace sanitisation through urldecode().

WordPress.Security.NonceVerification in LH_Polls_Voting::handle_form_post / process_vote / process_change_vote

The nonce (lh_poll_nonce) is verified once at the top of handle_form_post() via wp_verify_nonce() before any $_POST data is processed. process_vote() and process_change_vote() are private methods called only after this check succeeds; PCP flags each method independently and cannot trace the call chain.