EscapeOutput: allow for typical pattern with _deprecated_file()

WordPress/Sniffs/Security/EscapeOutputSniff.php

@@ -198,6 +198,20 @@ public function process_token( $stackPtr ) {
 				$end_of_statement = ( $first_param['end'] + 1 );
 				unset( $first_param );
 			}
+
+			/*
+			 * If the first param to `_deprecated_file()` follows the typical `basename( __FILE__ )`
+			 * pattern, it doesn't need to be escaped.
+			 */
+			if ( '_deprecated_file' === $function ) {
+				$first_param = $this->get_function_call_parameter( $stackPtr, 1 );
+
+				// Quick check. This disregards comments.
+				if ( preg_match( '`^basename\s*\(\s*__FILE__\s*\)$`', $first_param['raw'] ) === 1 ) {
+					$stackPtr = ( $first_param['end'] + 2 );
+				}
+				unset( $first_param );
+			}
 		}
 
 		// Checking for the ignore comment, ex: //xss ok.

WordPress/Tests/Security/EscapeOutputUnitTest.inc

@@ -292,3 +292,6 @@ echo esc_html( get_the_title() ); // Ok.
 
 echo implode( '<br>', map_deep( $items, 'esc_html' ) ); // Ok.
 echo implode( '<br>', map_deep( $items, 'foo' ) ); // Bad.
+
+_deprecated_file( basename( __FILE__ ), '1.3.0' ); // Ok.
+_deprecated_file( $file, '1.3.0' ); // Error.

WordPress/Tests/Security/EscapeOutputUnitTest.php

@@ -80,6 +80,7 @@ public function getErrorList() {
 			266 => 1,
 			289 => 1,
 			294 => 1,
+			297 => 1,
 		);
 	}