Escaping sniff bug

[GaryJones]

Original Issue: Automattic/VIP-Coding-Standards#22

---

<?php echo MY_CLASS()->get_template_part( 'post/feature-title', $vars ); ?>

reports issue with MY_CLASS and $vars, but should really only for MY_CLASS

Another edge case:

 <?php echo MY_CLASS()->get_template_part( 'post/feature-meta', array( 'obj' => $obj ) ); ?>

Another false positive is being reported on following code:

<?php echo ( $is_mobile ) ? wp_json_encode( 'true' ) : wp_json_encode( 'false' ); ?>

Taking the first example into consideration I can see following:

$ cat test.php
<?php

echo MY_CLASS()->get_template_part( 'post/feature-title', $vars );
$ phpcs --standard=WordPressVIPMinimum ./test.php -s

FILE: /home/wpcom/public_html/test.php
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
FOUND 2 ERRORS AFFECTING 1 LINE
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 3 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found 'MY_CLASS'. (WordPress.XSS.EscapeOutput.OutputNotEscaped)
 3 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$vars'. (WordPress.XSS.EscapeOutput.OutputNotEscaped)
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Time: 50ms; Memory: 6Mb

To directly answer the question, it's the WordPress.XSS.EscapeOutput.OutputNotEscaped sniff :)

---

Opening as a reminder to investigate.

Note, that this sniff got moved to WordPress.Security category for WPCS 1.0.0, so the original bug might have been addressed by now.

[jrfnl]

The first two are a different issue then the third example.

For the first two, I'm not sure I agree those should be changed, that whole chained function call should be flagged as needing escaping.

The third, I'm aware of and have some additional test cases for already.

[GaryJones]

that whole chained function call should be flagged as needing escaping.

And as it reports the MY_CLASS, it does.

I think the issue here is the second (redundant) violation for the $vars as well, which is inside the method call.

I presume that for the second example, it reports MY_CLASS, and, redundantly, the $obj as well.

cc @david-binda

[jrfnl]

Marking the third example (the ternary) as a duplicate of #677

[jrfnl]

FYI: the third issue will definitely be fixed in WPCS 3.0.0. Not sure about the first two yet, though those are more message clarity than actual bugs.

[jrfnl]

Also noting that the first two cases are basically a duplicate of #749.