BadFunctions/Backticks: bug fix - report on each variable

The sniff would only report on the first variable found in the shell command, not on each variable.

Even though there would be a notice, the level could have been `warning` as the first variable seen was a non-user input variable, while a more serious `error` for a subsequently used user input variable would not be reported.

This has now been fixed by changing the check for a variable to a loop which will report a separate error/warning for each variable encountered in the command.

Author: jrfnl

Security/Sniffs/BadFunctions/BackticksSniff.php

@@ -28,13 +28,13 @@ public function register() {
 	public function process(File $phpcsFile, $stackPtr) {
 		$utils = \PHPCS_SecurityAudit\Security\Sniffs\UtilsFactory::getInstance();
 		$tokens = $phpcsFile->getTokens();
-        $closer = $phpcsFile->findNext(T_BACKTICK, $stackPtr + 1, null, false, null, true);
+		$closer = $phpcsFile->findNext(T_BACKTICK, $stackPtr + 1, null, false, null, true);
 		if (!$closer) {
 			return;
 		}
-        $s = $stackPtr + 1;
-		$s = $phpcsFile->findNext(T_VARIABLE, $s, $closer);
-        if ($s) {
+
+		$s = $stackPtr;
+		while (($s = $phpcsFile->findNext(T_VARIABLE, ($s + 1), $closer)) !== false) {
 			$msg = 'System execution with backticks detected with dynamic parameter';
 			if ($utils::is_token_user_input($tokens[$s])) {
 				$phpcsFile->addError($msg . ' directly from user input', $stackPtr, 'ErrSystemExec');

Security/Tests/BadFunctions/BackticksUnitTest.inc

@@ -10,6 +10,8 @@ $output = `$request['field']`; // Warning.
 
 $output = `git blame --date=short "$filename"`; // Warning.
 
+$output = `git blame --date=$_POST['key'] "$filename"`; // Warning + error.
+
 // Incomplete command. Ignore.
 // Intentional parse error. This should be the last test in the file.
 $output = `ls

Security/Tests/BadFunctions/BackticksUnitTest.php

@@ -26,6 +26,7 @@ public function getErrorList($testFile = '')
 			case 'BackticksUnitTest.inc':
 				return [
 					9  => 1,
+					13 => 1,
 				];
 
 			case 'BackticksUnitTest.Drupal7.inc':
@@ -70,6 +71,7 @@ public function getWarningList($testFile = '')
 					7  => 1,
 					8  => 1,
 					11 => 1,
+					13 => 1,
 				];
 
 			case 'BackticksUnitTest.Drupal7.inc':