Checking callbacks for restricted functions

WordPress/AbstractFunctionRestrictionsSniff.php

@@ -185,16 +185,27 @@ public function process_token( $stackPtr ) {
 			return;
 		}
 
+		$is_callback_function = $this->is_callback_function( $stackPtr );
+
 		// Preliminary check. If the content of the T_STRING is not one of the functions we're
 		// looking for, we can bow out before doing the heavy lifting of checking whether
 		// this is a function call.
-		if ( preg_match( $this->prelim_check_regex, $this->tokens[ $stackPtr ]['content'] ) !== 1 ) {
+		if ( ! $is_callback_function && preg_match( $this->prelim_check_regex, $this->tokens[ $stackPtr ]['content'] ) !== 1 ) {
 			return;
 		}
 
-		if ( true === $this->is_targetted_token( $stackPtr ) ) {
-			return $this->check_for_matches( $stackPtr );
+		if ( false === $this->is_targetted_token( $stackPtr ) ) {
+			return;
+		}
+
+		if ( $is_callback_function ) {
+			$callback_matches = $this->check_for_callback_matches( $stackPtr );
+			if ( ! empty( $callback_matches ) ) {
+				$stackPtr = $callback_matches;
+			}
 		}
+
+		return $this->check_for_matches( $stackPtr );
 	}
 
 	/**
@@ -277,6 +288,57 @@ public function check_for_matches( $stackPtr ) {
 		return min( $skip_to );
 	}
 
+	/**
+	 * Verify if the current token is one of the targetted functions as callback.
+	 *
+	 * @since 0.11.0
+	 *
+	 * @param int $stackPtr The position of the current token in the stack.
+	 *
+	 * @return int|void If a callback was found return stackPtr for where to skip to.
+	 */
+	public function check_for_callback_matches( $stackPtr ) {
+		$token_content = strtolower( $this->tokens[ $stackPtr ]['content'] );
+
+		$skip_to    = array();
+		$parameters = $this->get_function_call_parameters( $stackPtr );
+		$positions  = $this->callback_functions[ $token_content ];
+
+		foreach ( $positions as $position ) {
+
+			// Calculate the last argument if the position is negative.
+			if ( $position < 0 ) {
+				$position = count( $parameters ) + 1 + $position;
+			}
+
+			if ( ! isset( $parameters[ $position ] ) ) {
+				return;
+			}
+
+			// Only get function name not anonymous funtions.
+			$callback = $this->phpcsFile->findNext(
+				array( T_CONSTANT_ENCAPSED_STRING ),
+				$parameters[ $position ]['start'],
+				null, // Do not deine the end so to catch the second callback.
+				false,
+				null,
+				true
+			);
+
+			if ( ! $callback ) {
+				return;
+			}
+
+			$skip_to[] = $this->check_for_matches( $this->strip_quotes( $callback ) );
+		}
+
+		if ( empty( $skip_to ) || min( $skip_to ) === 0 ) {
+			return;
+		}
+
+		return min( $skip_to );
+	}
+
 	/**
 	 * Process a matched token.
 	 *
@@ -298,8 +360,6 @@ public function process_matched_token( $stackPtr, $group_name, $matched_content
 			$this->string_to_errorcode( $group_name . '_' . $matched_content ),
 			array( $matched_content )
 		);
-
-		return;
 	}
 
 	/**

WordPress/Sniff.php

@@ -851,6 +851,51 @@ abstract class Sniff implements PHPCS_Sniff {
 		'PHPUnit\Framework\TestCase'                 => true,
 	);
 
+	/**
+	 * List of known PHP and WP function which take a callback as an argument.
+	 *
+	 * Sorted alphabetically. Last updated on 8th March 2017.
+	 *
+	 * @since 0.15.0
+	 *
+	 * @var array <string function name> => <int callback argument position>
+	 */
+	protected $callback_functions = array(
+		'add_filter'                 => array( 2 ),
+		'add_action'                 => array( 2 ),
+		'array_diff_uassoc'          => array( -1 ), // = last argument passed.
+		'array_diff_ukey'            => array( -1 ), // = last argument passed.
+		'array_filter'               => array( 2 ),
+		'array_intersect_uassoc'     => array( -1 ), // = last argument passed.
+		'array_intersect_ukey'       => array( -1 ), // = last argument passed.
+		'array_map'                  => array( 1 ),
+		'array_reduce'               => array( 2 ),
+		'array_udiff_assoc'          => array( -1 ), // = last argument passed.
+		'array_udiff_uassoc'         => array( -1, -2 ), // = last argument passed.
+		'array_udiff'                => array( -1 ), // = last argument passed.
+		'array_uintersect_assoc'     => array( -1 ), // = last argument passed.
+		'array_uintersect_uassoc'    => array( -1, -2 ), // = last argument passed.
+		'array_uintersect'           => array( -1 ), // = last argument passed.
+		'array_walk'                 => array( 2 ),
+		'array_walk_recursive'       => array( 2 ),
+		'call_user_func'             => array( 1 ),
+		'call_user_func_array'       => array( 1 ),
+		'forward_static_call'        => array( 1 ),
+		'forward_static_call_array'  => array( 1 ),
+		'header_register_callback'   => array( 1 ),
+		'iterator_apply'             => array( 2 ),
+		'mb_ereg_replace_callback'   => array( 2 ),
+		'ob_start'                   => array( 1 ),
+		'preg_replace_callback'      => array( 2 ),
+		'register_shutdown_function' => array( 1 ),
+		'register_tick_function'     => array( 1 ),
+		'set_error_handler'          => array( 1 ),
+		'set_exception_handler'      => array( 1 ),
+		'uasort'                     => array( 2 ),
+		'uksort'                     => array( 2 ),
+		'usort'                      => array( 2 ),
+	);
+
 	/**
 	 * The current file being sniffed.
 	 *
@@ -2645,4 +2690,19 @@ public function is_use_of_global_constant( $stackPtr ) {
 		return true;
 	}
 
+	/**
+	 * Verify if the current token content is a function that accepts callbacks.
+	 *
+	 * @since 0.15.0
+	 *
+	 * @param int $stackPtr The position of the current token in the stack.
+	 *
+	 * @return bool Return true if the content is on the callback functions
+	 *              list else false.
+	 */
+	public function is_callback_function( $stackPtr ) {
+		$token_content = strtolower( $this->tokens[ $stackPtr ]['content'] );
+		return isset( $this->callback_functions[ $token_content ] );
+	}
+
 }

WordPress/Sniffs/Functions/FunctionRestrictionsSniff.php

@@ -24,6 +24,8 @@
  *                    This class is left here to prevent backward-compatibility breaks for
  *                    custom sniffs extending the old class and references to this
  *                    sniff from custom phpcs.xml files.
+ *             0.12.0 Use the UnitTest to check that callback functions are corectly
+ *                    being checked for.
  * @see        \WordPress\AbstractFunctionRestrictionsSniff
  */
 class FunctionRestrictionsSniff extends AbstractFunctionRestrictionsSniff {

WordPress/Tests/Functions/FunctionRestrictionsUnitTest.inc

@@ -0,0 +1,36 @@
+<?php
+
+// Warnings.
+add_filter( '', 'foobar' );
+add_action( '', 'foobar' );
+call_user_func( 'foobar' );
+call_user_func_array( 'foobar' );
+forward_static_call( 'foobar' );
+forward_static_call_array( 'foobar' );
+array_diff_uassoc( '', '', 'foobar' );
+array_diff_ukey( '', '', 'foobar' );
+array_filter( '', 'foobar' );
+array_intersect_uassoc( '', 'foobar' );
+array_intersect_ukey( '', 'foobar' );
+array_map( 'foobar' );
+array_reduce( '', 'foobar' );
+array_udiff_assoc( array(), 'foobar' );
+array_udiff_uassoc( array(), 'foobar', 'barfoo' );
+array_udiff( '', 'foobar' );
+array_uintersect_assoc( '', 'foobar' );
+array_uintersect_uassoc( '', 'foobar', 'barfoo' );
+array_uintersect( '', 'foobar' );
+array_walk( '', 'foobar' );
+array_walk_recursive( '', 'foobar' );
+iterator_apply( '', 'foobar' );
+usort( '', 'foobar' );
+uasort( '', 'foobar' );
+uksort( '', 'foobar' );
+preg_replace_callback( '', 'foobar' );
+mb_ereg_replace_callback( '', 'foobar' );
+header_register_callback( 'foobar' );
+ob_start( 'foobar' );
+set_error_handler( 'foobar' );
+set_exception_handler( 'foobar' );
+register_shutdown_function( 'foobar' );
+register_tick_function( 'foobar' );

WordPress/Tests/Functions/FunctionRestrictionsUnitTest.php

@@ -0,0 +1,66 @@
+<?php
+/**
+ * Unit test class for WordPress Coding Standard.
+ *
+ * @package WPCS\WordPressCodingStandards
+ * @link    https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards
+ * @license https://opensource.org/licenses/MIT MIT
+ */
+
+namespace WordPress\Tests\Functions;
+
+use PHP_CodeSniffer\Tests\Standards\AbstractSniffUnitTest;
+use WordPress\AbstractFunctionRestrictionsSniff;
+
+/**
+ * Unit test class for the FunctionRestrictions sniff.
+ *
+ * @package WPCS\WordPressCodingStandards
+ * @since   0.10.0
+ */
+class FunctionRestrictionsUnitTest extends AbstractSniffUnitTest {
+
+	/**
+	 * Add a number of extra restricted functions to unit test the abstract
+	 * FunctionRestrictions class.
+	 *
+	 * Note: as that class extends the abstract FunctionRestrictions class, that's
+	 * where we are passing the parameters to.
+	 */
+	protected function setUp() {
+		parent::setUp();
+
+		AbstractFunctionRestrictionsSniff::$unittest_groups = array(
+			'test' => array(
+				'type'      => 'warning',
+				'message'   => 'Detected usage of %s.',
+				'functions' => array(
+					'foobar',
+					'barfoo',
+				),
+			),
+		);
+	}
+
+	/**
+	 * Returns the lines where errors should occur.
+	 *
+	 * @return array <int line number> => <int number of errors>
+	 */
+	public function getErrorList() {
+		return array();
+	}
+
+	/**
+	 * Returns the lines where warnings should occur.
+	 *
+	 * @return array <int line number> => <int number of warnings>
+	 */
+	public function getWarningList() {
+		$array     = array_fill( 4, 33, 1 );
+		$array[18] = 2;
+		$array[21] = 2;
+		return $array;
+	}
+
+}