Apply suggestions from code review

Co-authored-by: Juliette <663378+jrfnl@users.noreply.github.com>

Author: rodrigoprimo

WordPress/Tests/Security/NonceVerificationUnitTest.1.inc

@@ -526,21 +526,29 @@ function different_function_name() {
 // phpcs:set WordPress.Security.NonceVerification customNonceVerificationFunctions[]
 
 function test_fully_qualified_call_to_global_nonce_verification_function() {
-    if ( ! IS_NUMERIC( $_POST['foo'] ) ) {
+    if ( ! IS_NUMERIC( $_POST['foo'] ) ) { // OK.
         return;
     }
 
-    \wp_verify_nonce( 'some_action' ); // OK.
+    \wp_verify_nonce( 'some_action' );
+}
+
+function test_namespace_relative_call_to_global_nonce_verification_function() {
+	if ( ! IS_NUMERIC( $_POST['foo'] ) ) { // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+		return;
+	}
+
+	namespace\wp_verify_nonce( 'some_action' );
 }
 
 function test_namespaced_calls_to_incorrect_functions() {
-    if ( ! is_numeric( $_POST['foo'] ) ) {
+    if ( ! is_numeric( $_POST['foo'] ) ) { // Bad - none of the below are the WP global functions, so no nonce verification.
         return;
     }
 
-    MyNamespace\wp_verify_nonce( 'some_action' ); // Bad.
-    \MyNamespace\check_admin_referer( 'some_action' ); // Bad.
-    namespace\check_ajax_referer( 'some_action' ); // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+    MyNamespace\wp_verify_nonce( 'some_action' );
+    \MyNamespace\check_admin_referer( 'some_action' );
+    namespace\Sub\check_ajax_referer( 'some_action' );
 }
 
 function allow_fully_qualified_key_exists_functions() {
@@ -556,13 +564,21 @@ function allow_fully_qualified_key_exists_functions_with_mixed_case() {
 		return;
 	}
 
-	\WP_VERIFY_NONCE( 'some_action' );
+	wp_verify_nonce( 'some_action' );
+}
+
+function allow_namespace_relative_call_to_global_key_exists_functions() {
+	if ( namespace\array_key_exists('foo', $_POST) === false ) { // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+		return;
+	}
+
+	wp_verify_nonce( 'some_action' );
 }
 
 function disallow_namespaced_key_exists_functions() {
     if ( MyNamespace\array_key_exists( 'foo', $_POST ) === false // Bad.
         || \MyNamespace\key_exists( 'foo', $_POST ) === false // Bad.
-        || namespace\key_exists( 'foo', $_POST ) === false // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+        || namespace\Sub\key_exists( 'foo', $_POST ) === false // Bad.
     ) {
         return;
     }
@@ -575,26 +591,34 @@ function allow_fully_qualified_type_test_functions() {
         return;
     }
 
-    \wp_verify_nonce( 'some_action' ); // OK.
+    \wp_verify_nonce( 'some_action' );
 }
 
 function allow_fully_qualified_type_test_functions_uppercase() {
-	if ( ! \IS_NUMERIC( $_POST['foo'] ) ) { // OK.
+	if ( ! \IS_int( $_POST['foo'] ) ) { // OK.
 		return;
 	}
 
-	\wp_verify_nonce( 'some_action' ); // OK.
+	\wp_verify_nonce( 'some_action' );
+}
+
+function allow_namespace_relative_call_to_global_type_test_functions() {
+	if ( ! namespace\is_numeric( $_POST['foo'] ) ) { // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+		return;
+	}
+
+	\wp_verify_nonce( 'some_action' );
 }
 
 function disallow_namespaced_type_test_functions() {
     if ( ! MyNamespace\is_bool( $_POST['foo'] ) // Bad.
-        || ! MyNamespace\is_object( $_POST['foo'] ) // Bad.
-        || ! namespace\is_string( $_POST['foo'] ) ) // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+        || ! \MyNamespace\is_object( $_POST['foo'] ) // Bad.
+        || ! namespace\Sub\is_string( $_POST['foo'] ) ) // Bad.
     {
         return;
     }
 
-    \wp_verify_nonce( 'some_action' ); // OK.
+    \wp_verify_nonce( 'some_action' );
 }
 
 function allow_fully_qualified_array_comparison_functions() {
@@ -603,10 +627,16 @@ function allow_fully_qualified_array_comparison_functions() {
     }
 }
 
+function allow_namespace_relative_call_to_global_array_comparison_functions() {
+	if ( namespace\in_array( $_GET['action'], $valid_actions, true ) ) { // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+		check_admin_referer( 'foo' );
+	}
+}
+
 function disallow_namespaced_array_comparison_functions() {
     if ( MyNamespace\in_array( $_GET['action'], $valid_actions, true ) // Bad.
         || \MyNamespace\array_search( array( 'subscribe', 'unsubscribe' ), $_GET['action'], true ) // Bad.
-        || namespace\array_keys( $_GET['actions'], 'my_action', true ) // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+        || namespace\Sub\array_keys( $_GET['actions'], 'my_action', true ) // Bad.
     ) {
         check_admin_referer( 'foo' );
     }
@@ -624,10 +654,16 @@ function allow_fully_qualified_unslashing_functions_mixed_case() {
 	echo $var;
 }
 
+function allow_namespace_relative_call_to_global_unslashing_functions() {
+	$var = namespace\stripslashes_from_strings_only( $_POST['foo'] ); // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+	wp_verify_nonce( $var );
+	echo $var;
+}
+
 function disallow_namespaced_unslashing_functions() {
     $var = MyNamespace\stripslashes_from_strings_only( $_POST['foo'] ); // Bad.
     $var = \MyNamespace\stripslashes_deep( $_POST['foo'] ); // Bad.
-    $var = namespace\wp_unslash( $_POST['foo'] ); // Bad, but should become ok once the sniff is able to resolve relative namespaces.
+    $var = namespace\Sub\wp_unslash( $_POST['foo'] ); // Bad.
     wp_verify_nonce( $var );
     echo $var;
 }

WordPress/Tests/Security/NonceVerificationUnitTest.php

@@ -76,15 +76,19 @@ public function getErrorList( $testFile = '' ) {
 					478 => 1,
 					524 => 2,
 					537 => 1,
-					563 => 1,
-					564 => 1,
-					565 => 1,
-					590 => 1,
-					591 => 1,
-					592 => 1,
-					628 => 1,
-					629 => 1,
-					630 => 1,
+					545 => 1,
+					571 => 1,
+					579 => 1,
+					580 => 1,
+					581 => 1,
+					606 => 1,
+					614 => 1,
+					615 => 1,
+					616 => 1,
+					658 => 1,
+					664 => 1,
+					665 => 1,
+					666 => 1,
 				);
 
 			case 'NonceVerificationUnitTest.2.inc':
@@ -117,9 +121,10 @@ public function getWarningList( $testFile = '' ) {
 				return array(
 					365 => 1,
 					379 => 1,
-					607 => 1,
-					608 => 1,
-					609 => 1,
+					631 => 1,
+					637 => 1,
+					638 => 1,
+					639 => 1,
 				);
 
 			case 'NonceVerificationUnitTest.4.inc':