OffloadingSniff.php

<?php
/**
 * OffloadingSniff
 *
 * Based on code from {@link https://github.com/WordPress/WordPress-Coding-Standards}
 * which is licensed under {@link https://opensource.org/licenses/MIT}.
 *
 * @package PluginCheck
 */

namespace PluginCheckCS\PluginCheck\Sniffs\CodeAnalysis;

use PHP_CodeSniffer\Exceptions\RuntimeException;
use PHP_CodeSniffer\Util\Tokens;
use PHPCSUtils\Tokens\Collections;
use PHPCSUtils\Utils\TextStrings;
use PluginCheckCS\PluginCheck\Helpers\OffloadingServicesTrait;
use WordPressCS\WordPress\Sniff;

/**
 * Verifies any images/styles/scripts are not loaded from external sources.
 *
 * @link https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/
 *
 * @since 1.1.0
 */
final class OffloadingSniff extends Sniff {
	use OffloadingServicesTrait;

	/**
	 * Returns an array of tokens this test wants to listen for.
	 *
	 * @return array
	 */
	public function register() {
		$targets   = Collections::textStringStartTokens();
		$targets[] = \T_INLINE_HTML;

		return $targets;
	}

	/**
	 * Processes this test, when one of its tokens is encountered.
	 *
	 * @param int $stackPtr The position of the current token in the stack.
	 *
	 * @return int|void Integer stack pointer to skip forward or void to continue
	 *                  normal file processing.
	 */
	public function process_token( $stackPtr ) {
		$end_ptr = $stackPtr;
		$content = $this->tokens[ $stackPtr ]['content'];

		if ( \T_INLINE_HTML !== $this->tokens[ $stackPtr ]['code'] ) {
			try {
				$end_ptr = TextStrings::getEndOfCompleteTextString( $this->phpcsFile, $stackPtr );
				$content = TextStrings::getCompleteTextString( $this->phpcsFile, $stackPtr );
			} catch ( RuntimeException $e ) {
				// Parse error/live coding.
				return;
			}
		}

		if ( empty( trim( $content ) ) ) {
			return;
		}

		// Skip check if the string is within wp_enqueue_script/etc function calls,
		// as EnqueuedResourceOffloadingSniff already handles those and we want to avoid double reporting.
		if ( isset( $this->tokens[ $stackPtr ]['nested_parenthesis'] ) ) {
			foreach ( $this->tokens[ $stackPtr ]['nested_parenthesis'] as $opener => $closer ) {
				$prev = $this->phpcsFile->findPrevious( Tokens::$emptyTokens, ( $opener - 1 ), null, true );
				if ( false !== $prev && \T_STRING === $this->tokens[ $prev ]['code'] ) {
					$function_name = $this->tokens[ $prev ]['content'];
					if ( in_array( $function_name, array( 'wp_enqueue_script', 'wp_enqueue_style', 'wp_register_script', 'wp_register_style' ), true ) ) {
						return ( $end_ptr + 1 );
					}
				}
			}
		}

		// First check: Always check against known offloading services pattern for all strings.
		$pattern = $this->get_offloading_services_pattern();

		$matches = array();
		if ( preg_match_all( $pattern, $content, $matches, PREG_OFFSET_CAPTURE ) > 0 ) {
			foreach ( $matches[0] as $match ) {
				$this->phpcsFile->addError(
					'Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.',
					$this->find_token_in_multiline_string( $stackPtr, $content, $match[1] ),
					'OffloadedContent'
				);
			}
			return ( $end_ptr + 1 );
		}

		// Second check: For HTML markup strings only, also check file extension-based patterns.
		// This is limited to HTML context to avoid false positives on arbitrary URLs.

		if (
			false === strpos( $content, '<img' ) &&
			false === strpos( $content, '<video' ) &&
			false === strpos( $content, '<audio' ) &&
			false === strpos( $content, '<source' ) &&
			false === strpos( $content, '<link' ) &&
			false === strpos( $content, '<script' )
		) {
			return ( $end_ptr + 1 );
		}

		// Known offloading extensions.
		$look_known_offloading_ext = array(
			'css',
			'svg',
			'jpg',
			'jpeg',
			'gif',
			'png',
			'webm',
			'mp4',
			'mpg',
			'mpeg',
			'mp3',
			'json',
		);

		$offloading_ext = '\.' . implode( '|\.', $look_known_offloading_ext );
		$pattern        = '/(https?:\/\/[www\.]?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b[-a-zA-Z0-9()@:%_\+.~#?&\/\/=]*(' . $offloading_ext . '){1})[\/]?([\?|#]{1}[-a-zA-Z0-9()@:%_\+.~#?&\/\/=]*)?[\s|\'|"]/';

		$matches = array();
		if ( preg_match_all( $pattern, $content, $matches, PREG_OFFSET_CAPTURE ) > 0 ) {
			foreach ( $matches[0] as $match ) {
				$this->phpcsFile->addError(
					'Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.',
					$this->find_token_in_multiline_string( $stackPtr, $content, $match[1] ),
					'OffloadedContent'
				);
			}
		}

		return ( $end_ptr + 1 );
	}

	/**
	 * Find the exact token on which the error should be reported for multi-line strings.
	 *
	 * @param int    $stackPtr     The position of the current token in the stack.
	 * @param string $content      The complete, potentially multi-line, text string.
	 * @param int    $match_offset The offset within the content at which the match was found.
	 *
	 * @return int The stack pointer to the token containing the start of the match.
	 */
	private function find_token_in_multiline_string( $stackPtr, $content, $match_offset ) {
		$newline_count = 0;
		if ( $match_offset > 0 ) {
			$newline_count = substr_count( $content, "\n", 0, $match_offset );
		}

		// Account for heredoc/nowdoc text starting at the token *after* the opener.
		if ( isset( Tokens::$heredocTokens[ $this->tokens[ $stackPtr ]['code'] ] ) === true ) {
			++$newline_count;
		}

		return ( $stackPtr + $newline_count );
	}
}