From ef75f3f956fa113937fb537aaf244636a3416277 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Denis=20=C5=BDoljom?= Date: Wed, 30 Aug 2023 08:21:13 +0200 Subject: [PATCH] Sniff update WIP Need to write a recursive method that will check the fully qualified class names and if they have a static method call in them. We should also be careful not to catch the throw Exception cases, as for those we do want to check the parameters of the static method if they are escaped or not. --- WordPress/Sniffs/Security/EscapeOutputSniff.php | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/WordPress/Sniffs/Security/EscapeOutputSniff.php b/WordPress/Sniffs/Security/EscapeOutputSniff.php index 3618ada5a5..556e335603 100644 --- a/WordPress/Sniffs/Security/EscapeOutputSniff.php +++ b/WordPress/Sniffs/Security/EscapeOutputSniff.php @@ -738,13 +738,25 @@ protected function check_code_is_escaped( $start, $end ) { $content = $functionName; // Check if it's static method call. - $double_colon = $this->phpcsFile->findNext( Tokens::$emptyTokens, ( $i + 1 ), $end, true ); - if ( false !== $double_colon + $next_non_empty = $this->phpcsFile->findNext( Tokens::$emptyTokens, ( $i + 1 ), $end, true ); + if ( false !== $next_non_empty && \T_DOUBLE_COLON === $this->tokens[ $double_colon ]['code'] ) { // Set the pointer to the end of the method. $i = $this->phpcsFile->findNext( \T_CLOSE_PARENTHESIS, $i, $end ); } + + // Check if the class is fully qualified (namespaced), then check for the double colon (static method). + if ( false !== $next_non_empty + && \T_NS_SEPARATOR === $this->tokens[ $double_colon ]['code'] + ) { + + } + + // Checking for fully qualified name - go and find all the T_STRING and T_NS_SEPARATOR until the T_DOUBLE_COLON token. + + + } else { $content = $this->tokens[ $i ]['content']; $ptr = $i;