phpmd.xml

<?xml version="1.0" encoding="UTF-8"?>
<ruleset name="WordPress Plugin PHPMD Ruleset"
         xmlns="http://pmd.sf.net/ruleset/1.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://pmd.sf.net/ruleset/1.0.0 http://pmd.sf.net/ruleset_xml_schema.xsd"
         xsi:noNamespaceSchemaLocation="http://pmd.sf.net/ruleset_xml_schema.xsd">

    <description>WordPress-compatible PHPMD rules - enforces WordPress coding standards and spacing conventions</description>

    <!-- WordPress-specific file patterns to exclude -->
    <exclude-pattern>*/vendor/*</exclude-pattern>
    <exclude-pattern>*/node_modules/*</exclude-pattern>
    <exclude-pattern>*/tests/*</exclude-pattern>
    <exclude-pattern>*/assets/*</exclude-pattern>

    <!-- Clean Code Rules (with WordPress exceptions) -->
    <rule ref="rulesets/cleancode.xml">
        <!-- Exclude ElseExpression - WordPress often requires else for security patterns -->
        <exclude name="ElseExpression"/>
        <!-- Exclude MissingImport - WordPress core classes are auto-loaded -->
        <exclude name="MissingImport"/>
        <!-- Exclude StaticAccess - Allow for singleton patterns common in WordPress -->
        <exclude name="StaticAccess"/>
        <!-- Exclude BooleanArgumentFlag - WordPress hooks often use boolean flags -->
        <exclude name="BooleanArgumentFlag"/>
    </rule>
    
    <!-- Code Size Rules (WordPress-adjusted) -->
    <rule ref="rulesets/codesize.xml">
        <!-- Exclude TooManyPublicMethods - WordPress plugins need many public hook callbacks -->
        <exclude name="TooManyPublicMethods"/>
        <!-- Exclude TooManyMethods - WordPress classes often have many methods for hooks -->
        <exclude name="TooManyMethods"/>
        <!-- Exclude ExcessiveClassComplexity - WordPress plugins can be complex -->
        <exclude name="ExcessiveClassComplexity"/>
    </rule>
    
    <!-- WordPress-adjusted complexity limits -->
    <rule ref="rulesets/codesize.xml/TooManyPublicMethods">
        <properties>
            <!-- WordPress plugins often need many public hook callbacks -->
            <property name="maxmethods" value="20"/>
        </properties>
    </rule>
    
    <rule ref="rulesets/codesize.xml/TooManyMethods">
        <properties>
            <!-- WordPress classes often have many methods for different hooks -->
            <property name="maxmethods" value="25"/>
        </properties>
    </rule>
    
    <rule ref="rulesets/codesize.xml/ExcessiveMethodLength">
        <properties>
            <!-- Allow longer methods for WordPress template functions -->
            <property name="minimum" value="150"/>
        </properties>
    </rule>
    
    <rule ref="rulesets/codesize.xml/ExcessiveClassLength">
        <properties>
            <!-- WordPress plugin main classes can be large -->
            <property name="minimum" value="1500"/>
        </properties>
    </rule>
    
    <rule ref="rulesets/codesize.xml/CyclomaticComplexity">
        <properties>
            <!-- WordPress functions often have conditional logic for hooks -->
            <property name="reportLevel" value="15"/>
        </properties>
    </rule>
    
    <!-- Controversial Rules (with WordPress exceptions) -->
    <rule ref="rulesets/controversial.xml">
        <!-- Exclude Superglobals - WordPress securely uses $_GET, $_POST, etc. -->
        <exclude name="Superglobals"/>
        <!-- Exclude CamelCaseClassName - WordPress uses Snake_Case_Class_Names -->
        <exclude name="CamelCaseClassName"/>
        <!-- Exclude CamelCaseMethodName - WordPress uses snake_case_method_names -->
        <exclude name="CamelCaseMethodName"/>
        <!-- Exclude CamelCaseVariableName - WordPress uses $snake_case_variables -->
        <exclude name="CamelCaseVariableName"/>
        <!-- Exclude CamelCaseParameterName - WordPress uses $snake_case_parameters -->
        <exclude name="CamelCaseParameterName"/>
        <!-- Exclude CamelCasePropertyName - WordPress uses $snake_case_properties -->
        <exclude name="CamelCasePropertyName"/>
    </rule>
    
    <!-- Design Rules (with WordPress exceptions) -->
    <rule ref="rulesets/design.xml">
        <!-- Exclude ExitExpression - Required for WordPress wp_die(), exit, etc. -->
        <exclude name="ExitExpression"/>
        <!-- Exclude EvalExpression - WordPress sometimes uses eval for dynamic content -->
        <exclude name="EvalExpression"/>
        <!-- Exclude GotoStatement - WordPress core sometimes uses goto -->
        <exclude name="GotoStatement"/>
    </rule>
    
    <!-- WORDPRESS-SPECIFIC NAMING RULES -->
    <!-- WordPress uses snake_case naming which conflicts with standard camelCase rules -->
    <!-- Import only WordPress-compatible naming rules -->
    
    <rule ref="rulesets/naming.xml/ShortVariable">
        <properties>
            <!-- WordPress allows short variables like $id, $wp, but avoid single letters -->
            <property name="minimum" value="2"/>
        </properties>
    </rule>
    
    <rule ref="rulesets/naming.xml/LongVariable">
        <properties>
            <!-- WordPress descriptive variable names can be longer -->
            <property name="maximum" value="40"/>
        </properties>
    </rule>
    
    <rule ref="rulesets/naming.xml/ShortMethodName">
        <properties>
            <!-- WordPress allows short method names like get(), set(), but avoid very short -->
            <property name="minimum" value="2"/>
        </properties>
    </rule>
    
    <!-- Allow WordPress constructor patterns -->
    <rule ref="rulesets/naming.xml/ConstructorWithNameAsEnclosingClass"/>
    
    <!-- WordPress constant naming (UPPER_CASE_WITH_UNDERSCORES) -->
    <rule ref="rulesets/naming.xml/ConstantNamingConventions"/>
    
    <!-- WordPress boolean method naming (is_*, has_*, can_*) -->
    <rule ref="rulesets/naming.xml/BooleanGetMethodName"/>
    
    <!-- EXPLICITLY EXCLUDED NAMING RULES FOR WORDPRESS COMPATIBILITY -->
    <!-- These rules are NOT included because they conflict with WordPress standards: -->
    <!-- - CamelCaseClassName (WordPress uses Class_Name_With_Underscores) -->
    <!-- - CamelCaseMethodName (WordPress uses method_name_with_underscores) -->
    <!-- - CamelCaseVariableName (WordPress uses $variable_name_with_underscores) -->
    <!-- - CamelCaseParameterName (WordPress uses $parameter_name_with_underscores) -->
    <!-- - CamelCasePropertyName (WordPress uses $property_name_with_underscores) -->
    
    <!-- Unused Code Rules (always enforce) -->
    <rule ref="rulesets/unusedcode.xml"/>

    <!-- WORDPRESS CODING STANDARDS ENFORCEMENT -->
    <!-- Note: PHPMD doesn't directly enforce spacing/indentation -->
    <!-- For spacing enforcement, use PHPCS with WordPress standards instead -->
    <!-- This PHPMD config focuses on code quality and WordPress-compatible naming -->
    
    <!-- Custom WordPress-specific rules -->
    <rule name="WordPressSecurityRule"
          message="Use WordPress sanitization functions for user input"
          class="net.sourceforge.pmd.lang.rule.XPathRule">
        <description>
            Ensure WordPress sanitization functions are used for user input
        </description>
        <properties>
            <property name="xpath">
                <value>
                //FunctionCall[FunctionName/@Image='$_GET' or FunctionName/@Image='$_POST' or FunctionName/@Image='$_REQUEST']
                [not(ancestor::FunctionCall[FunctionName/@Image='sanitize_text_field' or FunctionName/@Image='wp_unslash' or FunctionName/@Image='esc_html' or FunctionName/@Image='esc_attr'])]
                </value>
            </property>
        </properties>
        <priority>2</priority>
    </rule>

</ruleset>