Security/Mustache: bug fix - potential false positives for delimiter change

The sniff didn't have enough guard code to safeguard that the test cases I've added in this commit would be handled correctly.

Fixed now.

Author: jrfnl

WordPressVIPMinimum/Sniffs/Security/MustacheSniff.php

@@ -56,12 +56,20 @@ public function process_token( $stackPtr ) {
 			$this->phpcsFile->addWarning( $message, $stackPtr, 'VariableNotation' );
 		}
 
-		if ( strpos( $this->tokens[ $stackPtr ]['content'], '{{=' ) !== false ) {
+		$start_delimiter_change = strpos( $this->tokens[ $stackPtr ]['content'], '{{=' );
+		if ( $start_delimiter_change !== false ) {
 			// Mustache delimiter change.
-			$new_delimiter = trim( str_replace( [ '{{=', '=}}' ], '', substr( $this->tokens[ $stackPtr ]['content'], 0, strpos( $this->tokens[ $stackPtr ]['content'], '=}}' ) + 3 ) ) );
-			$message       = 'Found Mustache delimiter change notation. New delimiter is: %s.';
-			$data          = [ $new_delimiter ];
-			$this->phpcsFile->addWarning( $message, $stackPtr, 'DelimiterChange', $data );
+
+			$end_delimiter_change = strpos( $this->tokens[ $stackPtr ]['content'], '=}}' );
+			if ( $end_delimiter_change !== false && $start_delimiter_change < $end_delimiter_change ) {
+				$start_new_delimiter = $start_delimiter_change + 3;
+				$end_new_delimiter   = $end_delimiter_change - ( $start_delimiter_change + 3 );
+				$new_delimiter       = substr( $this->tokens[ $stackPtr ]['content'], $start_new_delimiter, $end_new_delimiter );
+
+				$message = 'Found Mustache delimiter change notation. New delimiter is: %s.';
+				$data    = [ $new_delimiter ];
+				$this->phpcsFile->addWarning( $message, $stackPtr, 'DelimiterChange', $data );
+			}
 		}
 
 		if ( strpos( $this->tokens[ $stackPtr ]['content'], 'SafeString' ) !== false ) {

WordPressVIPMinimum/Tests/Security/MustacheUnitTest.inc

@@ -40,3 +40,10 @@ echo <<<'NOW'
 {{=<% %>=}} <!-- NOK: delimiter change -->
 </script>
 NOW;
+
+// Don't throw false positives on incorrect/incomplete mustache delimiter change.
+$m = '{{=<%'; // Missing end of delimiter change.
+$m = '%>=}} {{=<%'; // Incorrect order, not a delimiter change.
+
+// Correctly recognize mid-line delimiter change.
+$m = '{{default_tags}} {{=<% %>=}} <% erb_style_tags %> <%={{ }}=%> {{ default_tags_again }}'; // NOK: delimiter change.

WordPressVIPMinimum/Tests/Security/MustacheUnitTest.php

@@ -45,6 +45,7 @@ public function getWarningList() {
 			38 => 1,
 			39 => 1,
 			40 => 1,
+			49 => 1,
 		];
 	}
 }