From 363c6349118e225376ec0e0b152649f0b46e069e Mon Sep 17 00:00:00 2001
From: Peter Wilson <519727+peterwilsoncc@users.noreply.github.com>
Date: Mon, 27 Feb 2023 15:03:43 +1100
Subject: [PATCH 1/2] Enable Nonce Verification Sniff.

---
 10up-Default/ruleset.xml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/10up-Default/ruleset.xml b/10up-Default/ruleset.xml
index 2730331..6821278 100644
--- a/10up-Default/ruleset.xml
+++ b/10up-Default/ruleset.xml
@@ -63,9 +63,6 @@
 
 		<!-- Allow WP global modification -->
 		<exclude name="WordPress.WP.GlobalVariablesOverride.Prohibited"/>
-
-		<!-- This nonce sniff almost never works right -->
-		<exclude name="WordPress.Security.NonceVerification.Missing"/>
 	</rule>
 
 	<!-- Sets the minimum supported WP version to 4.7, which is over a year old. -->

From 53b05e2b09c0807cd6b08b48cbf2dde919a18ce3 Mon Sep 17 00:00:00 2001
From: Peter Wilson <519727+peterwilsoncc@users.noreply.github.com>
Date: Mon, 27 Feb 2023 15:23:25 +1100
Subject: [PATCH 2/2] Consider the nonce unslashed and sanitized.

---
 10up-Default/ruleset.xml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/10up-Default/ruleset.xml b/10up-Default/ruleset.xml
index 6821278..f7a456f 100644
--- a/10up-Default/ruleset.xml
+++ b/10up-Default/ruleset.xml
@@ -84,6 +84,24 @@
 	<!-- Make sure that the proper escaping functions are being used -->
 	<rule ref="WordPressVIPMinimum.Security.ProperEscapingFunction"/>
 
+
+	<rule ref="WP.Security.ValidatedSanitizedInput">
+		<properties>
+			<property name="customUnslashingSanitizingFunctions" type="array">
+				<!--
+					Allow checking nonces without sanitization.
+					
+					WordPress nonces do not include any characters requiring
+					slashes so can be considered unslashed. The verification
+					is a character by character comparison to a fixed value
+					so sanitization is not required as only a valid nonce
+					string should be allowed to pass.
+				-->
+				<element value="wp_verify_nonce" />
+			</property>
+		</properties>
+	</rule>
+
 	<!-- Loads the PHP Compatibility ruleset. -->
 	<rule ref="PHPCompatibilityWP" />