diff --git a/tests/checks/test-EscapingCheck.php b/tests/checks/test-EscapingCheck.php new file mode 100644 index 0000000..24a53d4 --- /dev/null +++ b/tests/checks/test-EscapingCheck.php @@ -0,0 +1,113 @@ + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test_print_in_esc_attr() { + $file_contents = <<<'EOT' + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test_echo_in_esc_attr() { + $file_contents = <<<'EOT' + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test__e_in_attributes() { + $file_contents = <<<'EOT' + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + // Same as test__e_in_attributes() but w/ single quotes + public function test__e_in_attributes_with_single_quotes() { + $file_contents = <<<'EOT' + ''> +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test_the_permalink_in_esc_url() { + $file_contents = <<<'EOT' + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test_the_permalink_in_esc_url_raw() { + $file_contents = <<<'EOT' + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test_the_title_in_esc_html() { + $file_contents = <<<'EOT' +

+EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test_the_date_in_esc_js() { + $file_contents = <<<'EOT' + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test_the_excerpt_in_esc_textarea() { + $file_contents = <<<'EOT' + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + + public function test_the_content_in_esc_sql() { + $file_contents = <<<'EOT' + +EOT; + $error_slugs = $this->runCheck( $file_contents ); + + $this->assertContains( 'functions-file', $error_slugs ); + } + +} \ No newline at end of file diff --git a/vip-scanner/checks/EscapingCheck.php b/vip-scanner/checks/EscapingCheck.php index 71be6a5..d2fbeaf 100644 --- a/vip-scanner/checks/EscapingCheck.php +++ b/vip-scanner/checks/EscapingCheck.php @@ -39,6 +39,10 @@ function check( $files ) { 'esc_attr_e()' ), ), + array( + 'pattern' => '/\ __( 'Escape method is being bypassed by calling a self-printing template tag.', 'vip-scanner' ), + ), ); foreach ( $checks as $check ) {