Security/Twig: bug fix - prevent false positives on interpolated expressions

Double quoted strings and heredocs may contain interpolated expressions, which could lead to false positives.

Fixed now.

Includes unit tests proving the bug.

Author: jrfnl

WordPressVIPMinimum/Sniffs/Security/TwigSniff.php

@@ -9,6 +9,7 @@
 namespace WordPressVIPMinimum\Sniffs\Security;
 
 use PHP_CodeSniffer\Util\Tokens;
+use PHPCSUtils\Utils\TextStrings;
 use WordPressVIPMinimum\Sniffs\Sniff;
 
 /**
@@ -40,14 +41,21 @@ public function register() {
 	 * @return void
 	 */
 	public function process_token( $stackPtr ) {
+		// Strip any potentially interpolated expressions.
+		$only_text = $this->tokens[ $stackPtr ]['content'];
+		if ( $this->tokens[ $stackPtr ]['code'] === T_DOUBLE_QUOTED_STRING
+			|| $this->tokens[ $stackPtr ]['code'] === T_HEREDOC
+		) {
+			$only_text = TextStrings::stripEmbeds( $only_text );
+		}
 
-		if ( preg_match( '/autoescape\s+false/', $this->tokens[ $stackPtr ]['content'] ) === 1 ) {
+		if ( preg_match( '/autoescape\s+false/', $only_text ) === 1 ) {
 			// Twig autoescape disabled.
 			$message = 'Found Twig autoescape disabling notation.';
 			$this->phpcsFile->addWarning( $message, $stackPtr, 'AutoescapeFalse' );
 		}
 
-		if ( preg_match( '/\|\s*raw/', $this->tokens[ $stackPtr ]['content'] ) === 1 ) {
+		if ( preg_match( '/\|\s*raw/', $only_text ) === 1 ) {
 			// Twig default unescape filter.
 			$message = 'Found Twig default unescape filter: "|raw".';
 			$this->phpcsFile->addWarning( $message, $stackPtr, 'RawFound' );

WordPressVIPMinimum/Tests/Security/TwigUnitTest.inc

@@ -25,7 +25,7 @@ echo '<script>
 
 echo "<script>
 {% autoescape false %}
-    Everything will be $outputted as is in this block
+    Everything will be $outputted as is in this {${$object->getBlock( SOME_FLAG | raw )}}
 {% endautoescape %}
 
 {% autoescape %}
@@ -49,7 +49,7 @@ EOD;
 echo <<<EOD
 <script>
 {% autoescape false %}
-    Everything will be $outputted as is in this block
+    Everything will be $outputted as is in this {$obj->blocks[SOME_FLAG | raw]->name}
 {% endautoescape %}
 EOD;
 echo <<<"EOD"