Merge pull request #1681 from WordPress-Coding-Standards/feature/escapeoutput-recognize-more-array-walking-functions

EscapeOutput: allow for map_deep() to output escape arrays

Author: GaryJones

WordPress/Sniffs/Security/EscapeOutputSniff.php

@@ -382,20 +382,32 @@ public function process_token( $stackPtr ) {
 
 				if ( false !== $function_opener ) {
 
-					if ( 'array_map' === $functionName ) {
-
-						// Get the first parameter (name of function being used on the array).
-						$mapped_function = $this->phpcsFile->findNext(
-							Tokens::$emptyTokens,
-							( $function_opener + 1 ),
-							$this->tokens[ $function_opener ]['parenthesis_closer'],
-							true
+					if ( isset( $this->arrayWalkingFunctions[ $functionName ] ) ) {
+
+						// Get the callback parameter.
+						$callback = $this->get_function_call_parameter(
+							$ptr,
+							$this->arrayWalkingFunctions[ $functionName ]
 						);
 
-						// If we're able to resolve the function name, do so.
-						if ( $mapped_function && \T_CONSTANT_ENCAPSED_STRING === $this->tokens[ $mapped_function ]['code'] ) {
-							$functionName = $this->strip_quotes( $this->tokens[ $mapped_function ]['content'] );
-							$ptr          = $mapped_function;
+						if ( ! empty( $callback ) ) {
+							/*
+							 * If this is a function callback (not a method callback array) and we're able
+							 * to resolve the function name, do so.
+							 */
+							$mapped_function = $this->phpcsFile->findNext(
+								Tokens::$emptyTokens,
+								$callback['start'],
+								( $callback['end'] + 1 ),
+								true
+							);
+
+							if ( false !== $mapped_function
+								&& \T_CONSTANT_ENCAPSED_STRING === $this->tokens[ $mapped_function ]['code']
+							) {
+								$functionName = $this->strip_quotes( $this->tokens[ $mapped_function ]['content'] );
+								$ptr          = $mapped_function;
+							}
 						}
 					}
 

WordPress/Tests/Security/EscapeOutputUnitTest.inc

@@ -289,3 +289,6 @@ echo esc_html( $something ),
 echo get_the_title(); // Bad.
 echo wp_kses_post( get_the_title() ); // Ok.
 echo esc_html( get_the_title() ); // Ok.
+
+echo implode( '<br>', map_deep( $items, 'esc_html' ) ); // Ok.
+echo implode( '<br>', map_deep( $items, 'foo' ) ); // Bad.

WordPress/Tests/Security/EscapeOutputUnitTest.php

@@ -79,6 +79,7 @@ public function getErrorList() {
 			264 => 1,
 			266 => 1,
 			289 => 1,
+			294 => 1,
 		);
 	}