57% no-unsafe-inline

Code Review | No unsafe-inline

WordPress plugin No unsafe-inline scored57%from 54 tests.

About plugin

  • Plugin page: no-unsafe-inline
  • Plugin version: 1.1.2
  • PHP compatiblity: 7.4+
  • PHP version: 7.4.16
  • WordPress compatibility: 5.2-6.2
  • WordPress version: 6.3.1
  • First release: Mar 25, 2022
  • Latest release: Jun 27, 2023
  • Number of updates: 35
  • Update frequency: every 13.2 days
  • Top authors: mociofiletto (100%)

Code review

54 tests

User reviews

2 reviews

Install metrics

60+ active /2,584 total downloads
Download (7.05 MB)

Benchmarks

Plugin footprint 64% from 16 tests

Installer Passed 1 test

🔺 Critical test (weight: 50) | The install procedure must perform silently
The plugin installed successfully, without throwing any errors or notices

Server metrics [RAM: ▲2.55MB] [CPU: ▲5.78ms] Passed 4 tests

A check of server-side resources used by No unsafe-inline
This plugin does not affect your website's performance
PageMemory (MB)CPU Time (ms)
Home /5.93 ▲2.4764.97 ▲19.85
Dashboard /wp-admin5.90 ▲2.5563.43 ▼5.11
Posts /wp-admin/edit.php5.93 ▲2.5867.37 ▲14.35
Add New Post /wp-admin/post-new.php8.57 ▲2.69109.70 ▼5.25
Media Library /wp-admin/upload.php5.84 ▲2.6155.11 ▲19.13
CSP settings /wp-admin/options-general.php?page=no-unsafe-inline6.0460.22

Server storage [IO: ▲30.46MB] [DB: ▲0.01MB] 33% from 3 tests

Input-output and database impact of this plugin
Just a few items left to fix
  • You have illegally modified 1 file (1.63KB) outside of "wp-content/plugins/no-unsafe-inline/" and "wp-content/uploads/"
    • (new file) wp-content/mu-plugins/no-unsafe-inline-output-buffering.php
  • Filesystem usage must be lower than 25MB (currently using 30.46MB)
Filesystem: 2,599 new files
Database: 5 new tables, 11 new options
New tables
wp_nunil_occurences
wp_nunil_event_handlers
wp_nunil_inline_scripts
wp_nunil_logs
wp_nunil_external_scripts
New WordPress options
no-unsafe-inline-tools
no-unsafe-inline_db_version
no-unsafe-inline
no-unsafe-inline_version
theysaidso_admin_options
no-unsafe-inline-base-rule
widget_recent-posts
can_compress_scripts
widget_theysaidso_widget
db_upgraded
...

Browser metrics Passed 4 tests

An overview of browser requirements for No unsafe-inline
This plugin renders optimally with no browser resource issues detected
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /2,793 ▲3214.72 ▲0.173.16 ▲1.3639.20 ▼4.98
Dashboard /wp-admin2,196 ▲195.54 ▲0.0199.14 ▼8.0351.71 ▲9.71
Posts /wp-admin/edit.php2,104 ▲41.98 ▼0.0336.08 ▼3.5033.64 ▲1.09
Add New Post /wp-admin/post-new.php1,541 ▲1523.19 ▲0.19650.42 ▼1.1051.27 ▲4.09
Media Library /wp-admin/upload.php1,407 ▲44.19 ▼0.01100.97 ▼5.5645.97 ▲2.02
CSP settings /wp-admin/options-general.php?page=no-unsafe-inline1,3772.2552.1442.30

Uninstaller [IO: ▲0.00MB] [DB: ▲0.00MB] 50% from 4 tests

🔸 Tests weight: 35 | The uninstall procedure must remove all plugin files and extra database tables
You still need to fix the following
  • This plugin does not fully uninstall, leaving 1 table in the database
    • wp_nunil_logs
  • The uninstall procedure has failed, leaving 9 options in the database
    • no-unsafe-inline-base-rule
    • no-unsafe-inline
    • theysaidso_admin_options
    • db_upgraded
    • widget_recent-posts
    • widget_recent-comments
    • can_compress_scripts
    • no-unsafe-inline-tools
    • widget_theysaidso_widget

Smoke tests 50% from 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | This is a short smoke test looking for server-side errors
Good news, no errors were detected

SRP 0% from 2 tests

🔹 Tests weight: 20 | The single-responsibility principle applies for WordPress plugins as well - please make sure your PHP files perform no actions when accessed directly
Please take a closer look at the following
  • 3× PHP files perform the task of outputting text when accessed with GET requests:
    • > /wp-content/plugins/no-unsafe-inline/admin/partials/class-no-unsafe-inline-base-rule-list.php
    • > /wp-content/plugins/no-unsafe-inline/public/partials/no-unsafe-inline-public-display.php
    • > /wp-content/plugins/no-unsafe-inline/admin/partials/no-unsafe-inline-logs.php
  • 893× PHP files trigger errors when accessed directly with GET requests (only 10 are shown):
    • > PHP Fatal error
      Uncaught Error: Class 'PHPUnit\\Framework\\TestCase' not found in wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/tests/NeuralNet/ActivationFunctions/ReLUTest.php:15
    • > PHP Fatal error
      Uncaught Error: Interface 'Amp\\Parallel\\Worker\\Task' not found in wp-content/plugins/no-unsafe-inline/vendor/amphp/parallel/lib/Worker/CallableTask.php:8
    • > PHP Fatal error
      Uncaught Error: Class 'PHPUnit\\Framework\\TestCase' not found in wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/tests/Specifications/ExtensionMinimumVersionTest.php:14
    • > PHP Fatal error
      Uncaught Error: Class 'Rubix\\ML\\Exceptions\\InvalidArgumentException' not found in wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/src/Exceptions/LabelsAreMissing.php:5
    • > PHP Fatal error
      Uncaught Error: Interface 'Rubix\\ML\\Transformers\\Transformer' not found in wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/src/Transformers/ImageResizer.php:21
    • > PHP Fatal error
      Uncaught Error: Interface 'League\\Uri\\Contracts\\PathInterface' not found in wp-content/plugins/no-unsafe-inline/vendor/league/uri-interfaces/src/Contracts/DataPathInterface.php:16
    • > PHP Fatal error
      Uncaught Error: Interface 'Amp\\Parallel\\Sync\\ExitResult' not found in wp-content/plugins/no-unsafe-inline/vendor/amphp/parallel/lib/Sync/ExitFailure.php:5
    • > PHP Fatal error
      Uncaught Error: Interface 'Rubix\\ML\\Graph\odes\\Decision' not found in wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/src/Graph/Nodes/Split.php:19
    • > PHP Fatal error
      Uncaught Error: Class 'PHPUnit\\Framework\\TestCase' not found in wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/tests/NeuralNet/Optimizers/RMSPropTest.php:18
    • > PHP Fatal error
      Uncaught Error: Interface 'Rubix\\ML\\Estimator' not found in wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/src/Classifiers/RadiusNeighbors.php:40

User-side errors Passed 1 test

🔹 Test weight: 20 | This is a smoke test targeting browser errors/issues
There were no browser issues found

Optimizations

Plugin configuration Passed 29 tests

readme.txt Passed 16 tests

Don't ignore readme.txt as it is the file that instructs WordPress.org on how to present your plugin to the world
5 plugin tags: content security policy, multisite, csp, security, unsafe-inline

no-unsafe-inline/no-unsafe-inline.php Passed 13 tests

This is the main PHP file of "No unsafe-inline" version 1.1.2, providing information about the plugin in the header fields and serving as the principal entry point to the plugin's functions
85 characters long description:
This plugin helps you to build a CSP to avoid using 'unsafe-inline' in your .htaccess

Code Analysis 0% from 3 tests

File types 0% from 1 test

🔸 Test weight: 35 | This is an overview of file extensions present in this plugin and a short test that no dangerous files are bundled with this plugin
It is important to fix the following items
  • Even if your plugin relies on executable files (for example a companion app), never distribute executable files with your plugin
    • .exe - Executable in Windows
      • ☣ wp-content/plugins/no-unsafe-inline/vendor/amphp/process/bin/windows/ProcessWrapper.exe
      • ☣ wp-content/plugins/no-unsafe-inline/vendor/amphp/process/bin/windows/ProcessWrapper64.exe
      • ☣ wp-content/plugins/no-unsafe-inline/vendor/php-ai/php-ml/bin/libsvm/svm-predict.exe
      • ☣ wp-content/plugins/no-unsafe-inline/vendor/php-ai/php-ml/bin/libsvm/svm-scale.exe
      • ☣ wp-content/plugins/no-unsafe-inline/vendor/php-ai/php-ml/bin/libsvm/svm-train.exe
    • .bat - Batch File in Windows
      • ☣ wp-content/plugins/no-unsafe-inline/vendor/rubix/tensor/build-ext.bat
223,627 lines of code in 2,352 files:
LanguageFilesBlank linesComment linesLines of code
PHP1,59027,50159,816136,463
JSON2230027,602
C483,8683,41025,741
Markdown2875,128214,791
CSS1051,5041,00211,707
C/C++ Header548723093,412
PO File13855961,490
YAML2120031,107
JavaScript1047103774
XML7100374
m4112079
make112033
Bourne Shell25131
Bourne Again Shell19822
DOS Batch1001

PHP code 0% from 2 tests

Analyzing cyclomatic complexity and code structure
Please tend to the following items
  • Class cyclomatic complexity has to be reduced to less than 1000 (currently 1,498)
  • Method cyclomatic complexity has to be reduced to less than 100 (currently 117)
Cyclomatic complexity
Average complexity per logical line of code0.35
Average class complexity9.70
▷ Minimum class complexity1.00
▷ Maximum class complexity1,498.00
Average method complexity2.49
▷ Minimum method complexity1.00
▷ Maximum method complexity117.00
Code structure
Namespaces208
Interfaces137
Traits19
Classes1,149
▷ Abstract classes282.44%
▷ Concrete classes1,12197.56%
▷ Final classes14813.20%
Methods7,362
▷ Static methods96613.12%
▷ Public methods6,30085.57%
▷ Protected methods5126.95%
▷ Private methods5507.47%
Functions545
▷ Named functions23142.39%
▷ Anonymous functions31457.61%
Constants940
▷ Global constants505.32%
▷ Class constants89094.68%
▷ Public constants37942.58%

Plugin size 50% from 2 tests

Image compression 50% from 2 tests

It is recommended to compress PNG files in your plugin to minimize bandwidth usage
61 PNG files occupy 0.67MB with 0.23MB in potential savings
Potential savings
Compression of 5 random PNG files using pngquant
FileSize - originalSize - compressedSavings
admin/css/jqueryui/1.13.1/themes/smoothness/images/ui-bg_glass_75_e6e6e6_1x400.png0.32KB0.15KB▼ 53.40%
admin/css/jqueryui/1.13.0/themes/smoothness/images/ui-icons_222222_256x240.png6.86KB4.18KB▼ 39.05%
admin/css/jqueryui/1.12.1/themes/smoothness/images/ui-icons_cd0a0a_256x240.png4.57KB4.18KB▼ 8.43%
admin/css/jqueryui/1.13.1/themes/smoothness/images/ui-bg_glass_95_fef1ec_1x400.png0.38KB0.15KB▼ 61.54%
admin/css/jqueryui/1.13.0/themes/smoothness/images/ui-icons_cd0a0a_256x240.png4.51KB4.18KB▼ 7.28%