ProperEscapingFunction: improve "action" match precision #670
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In VIPCS 2.2.0, checking for the use of
esc_url()
for "action" HTML attributes was introduced in PR #575 in response to issue #554.As it is not inconceivable that "action" is used as a suffix for custom HTML attributes - like "data-action"- for which the value does not necessarily has to be a URL, the check for the "action" HTML attribute should make sure it is the complete attribute name and not used as a suffix for a custom attribute name.
This change contains a minor refactor of the code which examines the content of the previous text string.
Instead of looping over the various lists and doing a
substr()
on the same content 25 times, it will now use a regular expression to gather the necessary information to throw the right errors in one go.Includes unit tests.
Fixes #669
Note: This PR removes two
private
properties which were introduced in 624/VIPCS 2.3.0 and twopublic
methods.The removal of the properties is safe. The removal of the
public
methods could be considered a BC-break as these methods werepublic
, though they never should have been.If so preferred, the
public
methods could be deprecated instead and remain in the code base as dead code/emptied out methods until the next major release upon which they could be removed.New commits since pulling
ProperEscapingFunction: fine-tune attribute regex
This adds test cases with:
... and makes minor adjustments to the regex to safeguard handling these cases correctly.
ProperEscapingFunction: deprecate, don't remove
... the
public
methods and as those use theprivate
properties and extending sniffs may rely on the functionality of thepublic
methods, we can't removed theprivate
properties yet either, so deprecating those too.