-
Notifications
You must be signed in to change notification settings - Fork 19
/
EscapeOutputSniff.php
69 lines (62 loc) · 1.71 KB
/
EscapeOutputSniff.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
<?php
namespace HM\Sniffs\Security;
use HM\Sniffs\ExtraSniffCode;
use PHP_CodeSniffer\Files\File as PhpcsFile;
use WordPressCS\WordPress\Sniffs\Security\EscapeOutputSniff as WPCSEscapeOutputSniff;
/**
* Verify all strings are escaped.
*
* This is subclassed from WPCS, as we need to disable warnings for error
* logging, as we don't output those to the page.
*
* @see https://github.com/WordPress/WordPress-Coding-Standards/issues/1864
*/
#[AllowDynamicProperties]
class EscapeOutputSniff extends WPCSEscapeOutputSniff {
use ExtraSniffCode;
/**
* Allowed functions which are treated by WPCS as printing functions.
*
* @var array
*/
protected $hmSafePrintingFunctions = [
'_deprecated_argument' => true,
'_deprecated_constructor' => true,
'_deprecated_file' => true,
'_deprecated_function' => true,
'_deprecated_hook' => true,
'_doing_it_wrong' => true,
'trigger_error' => true,
'user_error' => true,
];
/**
* Printing functions that incorporate unsafe values.
*
* This is overridden from the parent class to allow unescaped
* translated text.
*
* @var array
*/
protected $unsafePrintingFunctions = [];
/**
* Constructor.
*
* Removes non-printing functions from the property.
*/
public function __construct() {
// Remove error logging functions from output functions.
foreach ( $this->hmSafePrintingFunctions as $function => $val ) {
unset( $this->printingFunctions[ $function ] );
}
}
/**
* Override process to duplicate any ignores.
*
* @param PhpcsFile $file
* @param int $stackPtr
*/
public function process( PhpcsFile $file, $stackPtr ) {
$this->duplicate_ignores( $file, 'WordPress.Security.EscapeOutput' );
return parent::process( $file, $stackPtr );
}
}