From d4dd6903f8908b7d8b1e71e3e826b236d05119f2 Mon Sep 17 00:00:00 2001
From: Bernhard Reiter <ockham@raz.or.at>
Date: Mon, 16 Feb 2015 19:29:58 +0100
Subject: [PATCH] Add test for EscapingCheck, and update the latter a bit

---
 tests/checks/test-EscapingCheck.php  | 61 ++++++++++++++++++++++++++++
 tests/data/EscapingTest.inc          | 11 +++++
 vip-scanner/checks/EscapingCheck.php |  7 +++-
 3 files changed, 77 insertions(+), 2 deletions(-)
 create mode 100644 tests/checks/test-EscapingCheck.php
 create mode 100644 tests/data/EscapingTest.inc

diff --git a/tests/checks/test-EscapingCheck.php b/tests/checks/test-EscapingCheck.php
new file mode 100644
index 0000000..2adf069
--- /dev/null
+++ b/tests/checks/test-EscapingCheck.php
@@ -0,0 +1,61 @@
+<?php
+
+require_once( 'CodeCheckTestBase.php' );
+
+class EscapingTest extends CodeCheckTestBase {
+
+	public function testEscaping() {
+		$expected_errors = array(
+			array( 'slug' => 'functions-file',
+				'level' => BaseScanner::LEVEL_BLOCKER,
+				'description' => sprintf(
+					__( 'The function %1$s is being passed as the first parameter of %2$s. This is problematic because %1$s echoes a string which will not be escaped by %2$s.', 'vip-scanner' ),
+					'<code>printf()</code>',
+					'<code>esc_attr()</code>'
+				),
+				'file' => 'EscapingTest.inc',
+				'lines' => 5,
+			),
+			array( 'slug' => 'functions-file',
+					'level' => BaseScanner::LEVEL_BLOCKER,
+					'description' => sprintf(
+							__( '%1$s is being passed as the first parameter of %2$s.', 'vip-scanner' ),
+							'<code>print</code>',
+							'<code>esc_attr()</code>'
+					),
+					'file' => 'EscapingTest.inc',
+					'lines' => 6,
+			),
+			array( 'slug' => 'functions-file',
+					'level' => BaseScanner::LEVEL_BLOCKER,
+					'description' => sprintf(
+							__( '%1$s is being passed as the first parameter of %2$s.', 'vip-scanner' ),
+							'<code>echo</code>',
+							'<code>esc_attr()</code>'
+					),
+					'file' => 'EscapingTest.inc',
+					'lines' => 7,
+			),
+			array( 'slug' => 'functions-file',
+					'level' => BaseScanner::LEVEL_BLOCKER,
+					'description' => sprintf(
+							__( 'Please use %1$s to echo internationalized text in html attributes.', 'vip-scanner' ),
+							'<code>esc_attr_e()</code>'
+					),
+					'file' => 'EscapingTest.inc',
+					'lines' => 10,
+			),
+			array( 'slug' => 'functions-file',
+					'level' => BaseScanner::LEVEL_BLOCKER,
+					'description' => sprintf(
+							__( 'Please use %1$s to echo internationalized text in html attributes.', 'vip-scanner' ),
+							'<code>esc_attr_e()</code>'
+					),
+					'file' => 'EscapingTest.inc',
+					'lines' => 11,
+			),
+		);
+		$actual_errors = $this->checkFile( 'EscapingTest.inc' );
+		$this->assertEqualErrors( $expected_errors, $actual_errors );
+	}
+}
diff --git a/tests/data/EscapingTest.inc b/tests/data/EscapingTest.inc
new file mode 100644
index 0000000..1cf294c
--- /dev/null
+++ b/tests/data/EscapingTest.inc
@@ -0,0 +1,11 @@
+<?php
+
+die(); //Don't actually run the following code.
+
+esc_attr( printf( 'unescaped string' ) );
+esc_attr( print 'unescaped string' );
+esc_attr( echo 'unescaped string' );
+?>
+
+<a title="<?php _e( 'unescaped HTML attribute' ); ?>" />
+<a title='<?php _e( 'unescaped HTML attribute' ); ?>' />
diff --git a/vip-scanner/checks/EscapingCheck.php b/vip-scanner/checks/EscapingCheck.php
index 71be6a5..2d9c787 100644
--- a/vip-scanner/checks/EscapingCheck.php
+++ b/vip-scanner/checks/EscapingCheck.php
@@ -41,6 +41,7 @@ function check( $files ) {
 			),
 		);
 
+		$result = true;
 		foreach ( $checks as $check ) {
 			$this->increment_check_count();
 			foreach ( $this->filter_files( $files, 'php' ) as $path => $code ) {
@@ -51,11 +52,13 @@ function check( $files ) {
 						'functions-file',
 						$check['message'],
 						'blocker',
-						array( $filename, $line_number ),
-						esc_html( $error )
+						$filename,
+						array( $line_number => $error )
 					);
+					$result = false;
 				}
 			}
 		}
+		return $result;
 	}
 }
\ No newline at end of file