Hotfix - Lowercase custom sniff properties

WordPress/Helpers/EscapingFunctionsTrait.php

@@ -218,9 +218,15 @@ final public function is_escaping_function( $functionName ) {
 		if ( array() === $this->allEscapingFunctions
 			|| $this->customEscapingFunctions !== $this->addedCustomEscapingFunctions['escape']
 		) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_escaping_functions = array_map( 'strtolower', $this->customEscapingFunctions );
+			$escaping_functions        = array_change_key_case( $this->escapingFunctions, \CASE_LOWER );
+
 			$this->allEscapingFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customEscapingFunctions,
-				$this->escapingFunctions
+				$custom_escaping_functions,
+				$escaping_functions
 			);
 
 			$this->addedCustomEscapingFunctions['escape'] = $this->customEscapingFunctions;
@@ -242,9 +248,15 @@ final public function is_auto_escaped_function( $functionName ) {
 		if ( array() === $this->allAutoEscapedFunctions
 			|| $this->customAutoEscapedFunctions !== $this->addedCustomEscapingFunctions['autoescape']
 		) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_auto_escaped_functions = array_map( 'strtolower', $this->customAutoEscapedFunctions );
+			$auto_escaped_functions        = array_change_key_case( $this->autoEscapedFunctions, \CASE_LOWER );
+
 			$this->allAutoEscapedFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customAutoEscapedFunctions,
-				$this->autoEscapedFunctions
+				$custom_auto_escaped_functions,
+				$auto_escaped_functions
 			);
 
 			$this->addedCustomEscapingFunctions['autoescape'] = $this->customAutoEscapedFunctions;

WordPress/Helpers/PrintingFunctionsTrait.php

@@ -96,9 +96,15 @@ final public function get_printing_functions() {
 		if ( array() === $this->allPrintingFunctions
 			|| $this->customPrintingFunctions !== $this->addedCustomPrintingFunctions
 		) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_printing_functions = array_map( 'strtolower', $this->customPrintingFunctions );
+			$printing_functions        = array_change_key_case( $this->printingFunctions, \CASE_LOWER );
+
 			$this->allPrintingFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customPrintingFunctions,
-				$this->printingFunctions
+				$custom_printing_functions,
+				$printing_functions
 			);
 
 			$this->addedCustomPrintingFunctions = $this->customPrintingFunctions;

WordPress/Helpers/SanitizationHelperTrait.php

@@ -194,9 +194,15 @@ final public function get_sanitizing_functions() {
 		if ( array() === $this->allSanitizingFunctions
 			|| $this->customSanitizingFunctions !== $this->addedCustomSanitizingFunctions['sanitize']
 		) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_sanitizing_functions = array_map( 'strtolower', $this->customSanitizingFunctions );
+			$sanitizing_functions        = array_change_key_case( $this->sanitizingFunctions, \CASE_LOWER );
+
 			$this->allSanitizingFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customSanitizingFunctions,
-				$this->sanitizingFunctions
+				$custom_sanitizing_functions,
+				$sanitizing_functions
 			);
 
 			$this->addedCustomSanitizingFunctions['sanitize'] = $this->customSanitizingFunctions;
@@ -216,9 +222,15 @@ final public function get_sanitizing_and_unslashing_functions() {
 		if ( array() === $this->allUnslashingSanitizingFunctions
 			|| $this->customUnslashingSanitizingFunctions !== $this->addedCustomSanitizingFunctions['unslashsanitize']
 		) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_unslashing_sanitizing_functions = array_map( 'strtolower', $this->customUnslashingSanitizingFunctions );
+			$unslashing_sanitizing_functions        = array_change_key_case( $this->unslashingSanitizingFunctions, \CASE_LOWER );
+
 			$this->allUnslashingSanitizingFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customUnslashingSanitizingFunctions,
-				$this->unslashingSanitizingFunctions
+				$custom_unslashing_sanitizing_functions,
+				$unslashing_sanitizing_functions
 			);
 
 			$this->addedCustomSanitizingFunctions['unslashsanitize'] = $this->customUnslashingSanitizingFunctions;

WordPress/Sniffs/DB/DirectDatabaseQuerySniff.php

@@ -230,17 +230,17 @@ public function process_token( $stackPtr ) {
 			for ( $i = ( $scopeStart + 1 ); $i < $scopeEnd; $i++ ) {
 				if ( \T_STRING === $this->tokens[ $i ]['code'] ) {
 
-					if ( isset( $this->cacheDeleteFunctions[ $this->tokens[ $i ]['content'] ] ) ) {
+					if ( isset( $this->cacheDeleteFunctions[ strtolower( $this->tokens[ $i ]['content'] ) ] ) ) {
 
 						if ( \in_array( $method, array( 'query', 'update', 'replace', 'delete' ), true ) ) {
 							$cached = true;
 							break;
 						}
-					} elseif ( isset( $this->cacheGetFunctions[ $this->tokens[ $i ]['content'] ] ) ) {
+					} elseif ( isset( $this->cacheGetFunctions[ strtolower( $this->tokens[ $i ]['content'] ) ] ) ) {
 
 						$wp_cache_get = true;
 
-					} elseif ( isset( $this->cacheSetFunctions[ $this->tokens[ $i ]['content'] ] ) ) {
+					} elseif ( isset( $this->cacheSetFunctions[ strtolower( $this->tokens[ $i ]['content'] ) ] ) ) {
 
 						if ( $wp_cache_get ) {
 							$cached = true;
@@ -272,27 +272,45 @@ protected function mergeFunctionLists() {
 		}
 
 		if ( $this->customCacheGetFunctions !== $this->addedCustomFunctions['cacheget'] ) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_cache_get_functions = array_map( 'strtolower', $this->customCacheGetFunctions );
+			$cache_get_functions        = array_change_key_case( $this->cacheGetFunctions, \CASE_LOWER );
+
 			$this->cacheGetFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customCacheGetFunctions,
-				$this->cacheGetFunctions
+				$custom_cache_get_functions,
+				$cache_get_functions
 			);
 
 			$this->addedCustomFunctions['cacheget'] = $this->customCacheGetFunctions;
 		}
 
 		if ( $this->customCacheSetFunctions !== $this->addedCustomFunctions['cacheset'] ) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_cache_set_functions = array_map( 'strtolower', $this->customCacheSetFunctions );
+			$cache_set_functions        = array_change_key_case( $this->cacheSetFunctions, \CASE_LOWER );
+
 			$this->cacheSetFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customCacheSetFunctions,
-				$this->cacheSetFunctions
+				$custom_cache_set_functions,
+				$cache_set_functions
 			);
 
 			$this->addedCustomFunctions['cacheset'] = $this->customCacheSetFunctions;
 		}
 
 		if ( $this->customCacheDeleteFunctions !== $this->addedCustomFunctions['cachedelete'] ) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_cache_delete_functions = array_map( 'strtolower', $this->customCacheDeleteFunctions );
+			$cache_delete_functions        = array_change_key_case( $this->cacheDeleteFunctions, \CASE_LOWER );
+
 			$this->cacheDeleteFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customCacheDeleteFunctions,
-				$this->cacheDeleteFunctions
+				$custom_cache_delete_functions,
+				$cache_delete_functions
 			);
 
 			$this->addedCustomFunctions['cachedelete'] = $this->customCacheDeleteFunctions;

WordPress/Sniffs/Security/NonceVerificationSniff.php

@@ -310,7 +310,7 @@ private function has_nonce_check( $stackPtr, array $cache_keys, $allow_nonce_aft
 			}
 
 			// If this is one of the nonce verification functions, we can bail out.
-			if ( isset( $this->nonceVerificationFunctions[ $this->tokens[ $i ]['content'] ] ) ) {
+			if ( isset( $this->nonceVerificationFunctions[ strtolower( $this->tokens[ $i ]['content'] ) ] ) ) {
 				/*
 				 * Now, make sure it is a call to a global function.
 				 */
@@ -411,9 +411,15 @@ private function set_cache( $filename, $start, $end, $nonce ) {
 	 */
 	protected function mergeFunctionLists() {
 		if ( $this->customNonceVerificationFunctions !== $this->addedCustomNonceFunctions ) {
+			/*
+			 * Lowercase all names, both custom as well as "known", as PHP treats namespaced names case-insensitively.
+			 */
+			$custom_nonce_verification_functions = array_map( 'strtolower', $this->customNonceVerificationFunctions );
+			$nonce_verification_functions        = array_change_key_case( $this->nonceVerificationFunctions, \CASE_LOWER );
+
 			$this->nonceVerificationFunctions = RulesetPropertyHelper::merge_custom_array(
-				$this->customNonceVerificationFunctions,
-				$this->nonceVerificationFunctions
+				$custom_nonce_verification_functions,
+				$nonce_verification_functions
 			);
 
 			$this->addedCustomNonceFunctions = $this->customNonceVerificationFunctions;

WordPress/Tests/DB/DirectDatabaseQueryUnitTest.inc

@@ -333,6 +333,66 @@ function method_names_are_caseinsensitive() {
 	$autoload = $wpdb->Get_Var( $wpdb->Prepare( "SELECT autoload FROM $wpdb->options WHERE option_name = %s", $option_name ) ); // Warning x 2.
 }
 
+/*
+ * Test using custom properties, setting & unsetting (resetting).
+ */
+// phpcs:set WordPress.DB.DirectDatabaseQuery customCacheGetFunctions[] my_cacheget
+// phpcs:set WordPress.DB.DirectDatabaseQuery customCacheSetFunctions[] my_cacheset,my_other_cacheset
+// phpcs:set WordPress.DB.DirectDatabaseQuery customCacheDeleteFunctions[] my_cachedel
+function cache_customA() {
+	global $wpdb;
+	$quux = MY_cacheget( 'quux' );
+	if ( false !== $quux ) {
+		$wpdb->get_results( 'SELECT X FROM Y' ); // Warning direct DB call.
+		my_cacheSet( 'key', 'group' );
+	}
+}
+
+function cache_customB() {
+	global $wpdb;
+	$quux = my_cacheget( 'quux' );
+	if ( false !== $quux ) {
+		$wpdb->get_results( 'SELECT X FROM Y' ); // Warning direct DB call.
+		my_other_CacheSet( 'key', 'group' );
+	}
+}
+
+function cache_customC() {
+	global $wpdb;
+	$wpdb->query( 'SELECT X FROM Y' ); // Warning direct DB call.
+	my_cacheDEL( 'key', 'group' );
+}
+
+// phpcs:set WordPress.DB.DirectDatabaseQuery customCacheSetFunctions[] my_cacheset
+// phpcs:set WordPress.DB.DirectDatabaseQuery customCacheDeleteFunctions[]
+
+function cache_customD() {
+	global $wpdb;
+	$quux = my_cacheget( 'quux' );
+	if ( false !== $quux ) {
+		$wpdb->get_results( 'SELECT X FROM Y' ); // Warning direct DB call.
+		my_cacHeset( 'key', 'group' );
+	}
+}
+
+function cache_customE() {
+	global $wpdb;
+	$quux = my_cacheget( 'quux' );
+	if ( false !== $quux ) {
+		$wpdb->get_results( 'SELECT X FROM Y' ); // Warning x 2.
+		my_other_cacheset( 'key', 'group' );
+	}
+}
+
+function cache_customF() {
+	global $wpdb;
+	$wpdb->query( 'SELECT X FROM Y' ); // Warning x 2.
+	my_cachedel( 'key', 'group' );
+}
+
+// phpcs:set WordPress.DB.DirectDatabaseQuery customCacheGetFunctions[]
+// phpcs:set WordPress.DB.DirectDatabaseQuery customCacheSetFunctions[]
+
 // Live coding/parse error test.
 // This must be the last test in the file.
 $wpdb->get_col( '

WordPress/Tests/DB/DirectDatabaseQueryUnitTest.php

@@ -91,6 +91,12 @@ public function getWarningList() {
 			300 => 1,
 			306 => 2,
 			333 => 2,
+			346 => 1,
+			355 => 1,
+			362 => 1,
+			373 => 1,
+			382 => 2,
+			389 => 2,
 		);
 	}
 }

WordPress/Tests/Security/EscapeOutputUnitTest.1.inc

@@ -655,3 +655,9 @@ echo '<input type="search" value="' . get_search_query( false ) . '">'; // Bad.
 echo '<input type="search" value="' . get_search_query( 0 ) . '">'; // Bad.
 echo '<input type="search" value="' . get_search_query( escape: false ) . '">'; // OK, well not really, typo in param name, but that's not our concern.
 echo '<input type="search" value="' . get_search_query( escaped: false ) . '">'; // Bad.
+
+// phpcs:set WordPress.Security.EscapeOutput customPrintingFunctions[] to_screen,my_print
+to_scReen( $var1, esc_attr( $var2 ) ); // Bad x 1.
+my_prinT( $var1, $var2 ); // Bad x 2.
+
+// phpcs:set WordPress.Security.EscapeOutput customEscapingFunctions[]

WordPress/Tests/Security/EscapeOutputUnitTest.php

@@ -159,6 +159,8 @@ public function getErrorList( $testFile = '' ) {
 					654 => 1,
 					655 => 1,
 					657 => 1,
+					660 => 1,
+					661 => 2,
 				);
 
 			case 'EscapeOutputUnitTest.6.inc':

WordPress/Tests/Security/NonceVerificationUnitTest.1.inc

@@ -466,7 +466,7 @@ function function_containing_nested_enum_with_nonce_check() {
 			wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['my_nonce'] ) ), 'the_nonce' );
 		}
 	}
-	
+
 	echo $_POST['foo']; // Bad.
 }
 
@@ -486,3 +486,10 @@ enum MyEnum {
 		echo $_POST['foo']; // OK.
 	}
 }
+// phpcs:set WordPress.Security.NonceVerification customNonceVerificationFunctions[] my_nonce_check
+// phpcs:set WordPress.Security.NonceVerification customUnslashingSanitizingFunctions[] do_something
+function foo_6() {
+	my_noncE_cheCk( do_soMeThinG( $_POST['tweet'] ) ); // OK.
+}
+// phpcs:set WordPress.Security.NonceVerification customUnslashingSanitizingFunctions[]
+// phpcs:set WordPress.Security.NonceVerification customNonceVerificationFunctions[]

WordPress/Tests/Security/ValidatedSanitizedInputUnitTest.1.inc

@@ -500,3 +500,32 @@ function test_in_match_condition_is_regarded_as_comparison() {
 		};
 	}
 }
+
+/*
+ * Test using custom properties, setting & unsetting (resetting).
+ */
+function test_this() {
+	if ( ! isset( $_POST['abc_field'] ) ) {
+		return;
+	}
+
+	$abc = sanitize_color( wp_unslash( $_POST['abc_field'] ) ); // Bad x1 - sanitize.
+
+	// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] sanitize_color,sanitize_twitter_handle
+
+	$abc = sanitize_cOlor( wp_unslash( $_POST['abc_field'] ) ); // OK.
+	$abc = sanitize_facebook_ID( wp_unslash( $_POST['abc_field'] ) ); // Bad x1 - sanitize.
+	$abc = sanitize_twitteR_handle( $_POST['abc_field'] ); // Bad x1 - unslash.
+
+	// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] sanitize_color,sanitize_facebook_id
+	// phpcs:set WordPress.Security.ValidatedSanitizedInput customUnslashingSanitizingFunctions[] sanitize_twitter_handle
+
+	$abc = sanitizE_coLor( wp_unslash( $_POST['abc_field'] ) ); // OK.
+	$abc = sanitize_facebook_ID( wp_unslash( $_POST['abc_field'] ) ); // OK.
+	$abc = sanitize_TWITTER_haNdle( $_POST['abc_field'] ); // OK.
+
+	// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[]
+	// phpcs:set WordPress.Security.ValidatedSanitizedInput customUnslashingSanitizingFunctions[]
+
+	$abc = sanitize_twitter_handle( $_POST['abc_field'] ); // Bad x2, sanitize + unslash.
+}

WordPress/Tests/Security/ValidatedSanitizedInputUnitTest.php

@@ -114,6 +114,10 @@ public function getErrorList( $testFile = '' ) {
 					497 => 1,
 					498 => 1,
 					499 => 3,
+					512 => 1,
+					517 => 1,
+					518 => 1,
+					530 => 2,
 				);
 
 			case 'ValidatedSanitizedInputUnitTest.2.inc':