Merge pull request #50 from infinum/fix-edgecase-security-sniff

Fix edgecase security sniff

Author: dingo-d

CHANGELOG.md

@@ -10,6 +10,19 @@ The semantic versioning started from version 0.2.1.
 
 _No documentation available about unreleased changes yet._
 
+## [1.5.0](https://github.com/infinum/eightshift-coding-standards/compare/1.4.2...1.5.0) - 2022-03-16
+
+### Added
+- Add `overriddenClass` parameter for the EightShift ComponentsEscape sniff
+  - This parameter will catch the cases where the libs Components class has been overridden.
+- Add ignoreComments property for the line length sniff
+
+### Fixed
+- Fixed the edge case with overwriting libs classes. 
+
+### Changed
+- Code cleanup in EightShift ComponentsEscape sniff
+
 ## [1.4.2](https://github.com/infinum/eightshift-coding-standards/compare/1.4.1...1.4.2) - 2022-03-10
 
 ### Fixed

Eightshift/Sniffs/Security/ComponentsEscapeSniff.php

@@ -30,6 +30,18 @@
  */
 class ComponentsEscapeSniff extends EscapeOutputSniff
 {
+	/**
+	 * A fully qualified class name for Components class override
+	 *
+	 * You should put the fully qualified class name of the class you used
+	 * to override the EightshiftLibs\Helpers\Component class.
+	 *
+	 * For Example: namespace\\SomeSubNamespace\\MyComponents.
+	 *
+	 * @var string
+	 */
+	public $overriddenClass = '';
+
 	/**
 	 * Processes this test, when one of its tokens is encountered.
 	 *
@@ -42,21 +54,27 @@ public function process_token($stackPtr)
 	{
 		$tokens = $this->tokens;
 		$phpcsFile = $this->phpcsFile;
-		$importData = [];
+		$importData = [
+			'importExists' => false,
+			'fullImportExists' => false
+		];
 		$importExists = false;
 
 		// Check if the current token is a part of the import, if it is, skip the check.
 		$useToken = $phpcsFile->findPrevious(\T_USE, ($stackPtr - 1), null, false, null, false);
 
 		if ($useToken) {
-			$endOfUse = $phpcsFile->findNext(\T_SEMICOLON, $useToken, null, false, null, false);
+			// Find all use tokens.
+			foreach ($tokens as $tokenPtr => $token) {
+				if ($token['code'] === \T_USE) {
+					$importData = $this->checkIfImportInformation($tokenPtr, $importData);
 
-			// Ignore all the tokens that are a part of the import statement. Every import statement ends in the semicolon.
-			if ($stackPtr <= $endOfUse) {
-				return;
+					if ($importData['importExists']) {
+						break;
+					}
+				}
 			}
 
-			$importData = $this->checkIfImportInformation($stackPtr);
 			$importExists = $importData['importExists'];
 		}
 
@@ -110,8 +128,9 @@ public function process_token($stackPtr)
 				if ($importData['fullImportExists']) {
 					// Components name is ok, \Components is not ok, \Anything\Components is not ok FQCN is ok.
 					if (
-						$className === 'Components' ||
-						\strpos($className, 'EightshiftLibs\\Helpers\\Components') !== false
+						$className === 'Components'
+						|| \strpos($className, 'EightshiftLibs\\Helpers\\Components') !== false
+						|| (! empty($this->overriddenClass) && \strpos($className, $this->overriddenClass) !== false)
 					) {
 						// Check the static method name.
 						$methodNamePtr = $phpcsFile->findNext(
@@ -130,27 +149,13 @@ public function process_token($stackPtr)
 							return; // Skip sniffing allowed methods.
 						} else {
 							// Not allowed method, continue as usual.
-							$echoPtr = $phpcsFile->findPrevious(
-								\T_ECHO,
-								($componentsClassNamePtr - 1),
-								null,
-								false,
-								null,
-								true
-							);
+							$echoPtr = $this->getEchoToken($componentsClassNamePtr);
 
 							return parent::process_token($echoPtr);
 						}
 					} else {
 						// Some other class we don't care about.
-						$echoPtr = $phpcsFile->findPrevious(
-							\T_ECHO,
-							($componentsClassNamePtr - 1),
-							null,
-							false,
-							null,
-							true
-						);
+						$echoPtr = $this->getEchoToken($componentsClassNamePtr);
 
 						return parent::process_token($echoPtr);
 					}
@@ -180,34 +185,23 @@ public function process_token($stackPtr)
 							return; // Skip sniffing allowed methods.
 						} else {
 							// Not allowed method, continue as usual.
-							$echoPtr = $phpcsFile->findPrevious(
-								\T_ECHO,
-								($componentsClassNamePtr - 1),
-								null,
-								false,
-								null,
-								true
-							);
+							$echoPtr = $this->getEchoToken($componentsClassNamePtr);
 
 							return parent::process_token($echoPtr);
 						}
 					} else {
 						// Wrongly imported, or class that is not related to the libs.
-						$echoPtr = $phpcsFile->findPrevious(
-							\T_ECHO,
-							($componentsClassNamePtr - 1),
-							null,
-							false,
-							null,
-							true
-						);
+						$echoPtr = $this->getEchoToken($componentsClassNamePtr);
 
 						return parent::process_token($echoPtr);
 					}
 				}
 			} else {
 				// Check if the class name is fully qualified and contains the helper part.
-				if (\strpos($className, 'EightshiftLibs\\Helpers\\Components') !== false) {
+				if (
+					\strpos($className, 'EightshiftLibs\\Helpers\\Components') !== false
+					|| (! empty($this->overriddenClass) && \strpos($className, $this->overriddenClass) !== false)
+				) {
 					$methodNamePtr = $phpcsFile->findNext(
 						\T_STRING,
 						($componentsClassNamePtr + 1),
@@ -224,26 +218,12 @@ public function process_token($stackPtr)
 						return; // Skip sniffing allowed methods.
 					} else {
 						// Not allowed method, continue as usual.
-						$echoPtr = $phpcsFile->findPrevious(
-							\T_ECHO,
-							($componentsClassNamePtr - 1),
-							null,
-							false,
-							null,
-							true
-						);
+						$echoPtr = $this->getEchoToken($componentsClassNamePtr);
 
 						return parent::process_token($echoPtr);
 					}
 				} else {
-					$echoPtr = $phpcsFile->findPrevious(
-						\T_ECHO,
-						($componentsClassNamePtr - 1),
-						null,
-						false,
-						null,
-						true
-					);
+					$echoPtr = $this->getEchoToken($componentsClassNamePtr);
 
 					return parent::process_token($echoPtr);
 				}
@@ -258,48 +238,57 @@ public function process_token($stackPtr)
 	 * Checks if the import statement exists in the current file, for the given stack pointer
 	 *
 	 * @param int $stackPtr The position of the current token in the stack.
+	 * @param String[] $importData Import data array.
 	 *
 	 * @return array<string, bool|string> Information about the imports
 	 */
-	private function checkIfImportInformation($stackPtr): array
+	private function checkIfImportInformation(int $stackPtr, array $importData): array
 	{
-		$tokens = $this->tokens;
 		$phpcsFile = $this->phpcsFile;
 
-		$importData = [
-			'importExists' => false,
-			'fullImportExists' => false
-		];
+		$overriddenClass = \str_replace('\\\\', '\\', $this->overriddenClass);
 
-		// Check if the correct import exists at the top of the file.
-		$importPtr = $phpcsFile->findPrevious(\T_USE, ($stackPtr - 1), null, false, null, false);
+		if (UseStatements::isImportUse($phpcsFile, $stackPtr)) {
+			$importInfo = UseStatements::splitImportUseStatement($phpcsFile, $stackPtr);
 
-		if ($tokens[$importPtr]['code'] === \T_USE) {
-			if (UseStatements::isImportUse($phpcsFile, $importPtr)) {
-				$importInfo = UseStatements::splitImportUseStatement($phpcsFile, $importPtr);
+			if (!empty($importInfo)) {
+				foreach ($importInfo['name'] as $fullyQualifiedClassNameImport) {
+					if (
+						\strpos($fullyQualifiedClassNameImport, 'EightshiftLibs\\Helpers') !== false
+						|| (! empty($overriddenClass) && \strpos($fullyQualifiedClassNameImport, $overriddenClass) !== false)
+					) {
+						$importData['importExists'] = true;
+						$importData['importName'] = $fullyQualifiedClassNameImport;
 
-				if (!empty($importInfo)) {
-					foreach ($importInfo['name'] as $fullyQualifiedClassNameImport) {
-						// Check for partial import.
-						if (\strpos($fullyQualifiedClassNameImport, 'EightshiftLibs\\Helpers') !== false) {
-							$importData['importExists'] = true;
+						// Check for fully qualified import.
+						if (
+							\strpos($fullyQualifiedClassNameImport, 'EightshiftLibs\\Helpers\\Components') !== false
+							|| (! empty($overriddenClass) && \strpos($fullyQualifiedClassNameImport, $overriddenClass) !== false)
+						) {
+							$importData['fullImportExists'] = true;
 							$importData['importName'] = $fullyQualifiedClassNameImport;
 
-							// Check for fully qualified import.
-							if (\strpos($fullyQualifiedClassNameImport, 'EightshiftLibs\\Helpers\\Components') !== false) {
-								$importData['fullImportExists'] = true;
-								$importData['importName'] = $fullyQualifiedClassNameImport;
-
-								break;
-							}
-
 							break;
 						}
+
+						break;
 					}
 				}
 			}
 		}
 
 		return $importData;
 	}
+
+	/**
+	 * Return the position of the previous echo pointer
+	 *
+	 * @param int $stackPtr The position of the current token in the stack.
+	 *
+	 * @return int Token pointer number.
+	 */
+	private function getEchoToken(int $stackPtr): int
+	{
+		return $this->phpcsFile->findPrevious(\T_ECHO, ($stackPtr - 1), null, false, null, true);
+	}
 }