Performance/BatcacheWhitelistedParams: remove the sniff

* Remove the sniff.
* Remove the related test in the `WordPressVIPMinimum/ruleset-test.inc` file.
* Remove the error silencing from VIP-Go.
* Remove the related test in the `WordPress-VIP-Go/ruleset-test.inc` file.
    This one is a little more involved. Basically the call to `wp_verify_nonce()`, which is being removed, was "silencing" the nonce verification error for other tests as well, most notably for the tests on line 83-85, due to most tests being in the global scope.
    Looking at it more closely, turns out that line 83 wasn't testing what it was supposed to be testing.
    The error which was previously being thrown on line 83 was about the nonce verification being missing, while the test is annotated to be about the `WordPress.Security.ValidatedSanitizedInput[.InputNotSanitized]` error, which wasn't being thrown.
    Adding a nonce verification check on some empty lines above these tests gets rid of the nonce verification errors, but now left line 83 not testing anything at all (as no key is accessed in the superglobal).
    Adding a random key gets us the error which was intended to be thrown on this line, but now also adds the "missing validation" error. IMO, this is correct (better than it was before), so I'm also updating the test expectations for line 83.

Author: jrfnl

WordPress-VIP-Go/ruleset-test.inc

@@ -56,8 +56,8 @@ $x = sanitize_key( $_COOKIE['bar'] ); // phpcs:ignore WordPress.Security.Validat
 if ( isset( $_SERVER['HTTP_USER_AGENT'] ) && $_SERVER['HTTP_USER_AGENT'] === 'some_value' ) { // Error.
 }
 
-
-
+// Make sure nonce verification is done in global scope to silence notices about use of superglobals without later on in the file.
+isset( $_GET['my_nonce'] ) && wp_verify_nonce( sanitize_text_field( $_GET['my_nonce'] ) );
 
 // WordPress.WP.AlternativeFunctions.file_system_read_fopen
 fopen( 'file.txt', 'r' ); // Warning + Message.
@@ -80,7 +80,7 @@ function foo_bar() {
 }
 
 // WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
-do_something( $_POST ); // Error.
+do_something( $_POST['key'] ); // Error + warning.
 if ( isset( $_POST['foo2'] ) ) {
 	bar( wp_unslash( $_POST['foo2'] ) ); // Warning.
 }
@@ -279,10 +279,10 @@ $args( [
 $query = new WP_Query( ['meta_key' => 'foo' ] ); // Ok.
 $args = 'foo=bar&meta_key=foo'; // Ok.
 
-// WordPressVIPMinimum.Performance.BatcacheWhitelistedParams
-if ( isset( $_GET['migSource'] ) && wp_verify_nonce( sanitize_text_field( $_GET['migSource'] ) ) ) {
-	$test = sanitize_text_field( $_GET['migSource'] ); // Ok.
-}
+
+
+
+
 
 
 

WordPress-VIP-Go/ruleset-test.php

@@ -134,6 +134,7 @@
 		47  => 1,
 		63  => 1,
 		66  => 1,
+		83  => 1,
 		85  => 1,
 		90  => 1,
 		94  => 1,

WordPress-VIP-Go/ruleset.xml

@@ -243,10 +243,6 @@
 		<!-- We are silencing this one because VIP Go has a combined index on meta_key, meta_value-->
 		<severity>0</severity>
 	</rule>
-	<rule ref="WordPressVIPMinimum.Performance.BatcacheWhitelistedParams">
-		<!-- We are silencing this one because VIP Go does not use Batcache-->
-		<severity>0</severity>
-	</rule>
 	<rule ref="Generic.PHP.DisallowShortOpenTag.EchoFound">
 		<severity>0</severity>
 	</rule>

WordPressVIPMinimum/Sniffs/Performance/BatcacheWhitelistedParamsSniff.php

@@ -442,9 +442,9 @@ add_filter( 'robots_txt', function() { // Warning.
 	return 'test';
 } );
 
-// WordPressVIPMinimum.Performance.BatcacheWhitelistedParams
-// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
-$test = sanitize_text_field( $_GET["utm_medium"] ); // Warning.
+
+
+
 
 // WordPressVIPMinimum.Performance.CacheValueOverride
 $bad_wp_users = wp_cache_get( md5( self::CACHE_KEY . '_wp_users'), self::CACHE_GROUP );

WordPressVIPMinimum/Tests/Performance/BatcacheWhitelistedParamsUnitTest.inc

@@ -273,7 +273,6 @@
 		439 => 1,
 		440 => 1,
 		441 => 1,
-		447 => 1,
 		454 => 1,
 		457 => 1,
 		458 => 1,