register_rest_route-strings.php

#!/usr/bin/env php
<?php

/*
Usage:
$ ag --php --skip-vcs-ignores register_rest_route | tee scans/register_rest_route.txt
$ scans/register_rest_route-strings.php
*/

$f = fopen( dirname( __FILE__ ) . '/register_rest_route.txt', 'r' );
if ( ! $f ) {
	die();
}

while ( ( $line = fgets( $f ) ) !== false ) {
	preg_match( '#^(?P<path>[^:]+):(?P<line>\d+):(?P<code>.*)$#', $line, $matches );
	if ( ! $matches ) {
		error_log( "bad line: $line" );
		break;
	}

	$tokens = token_get_all( '<?php ' . $matches['code'] );
	$inside_string = false;
	foreach ( $tokens as $token ) {
		if ( is_array( $token ) ) {
			$token_name = token_name( $token[0] );
			if (
				$token_name === 'T_CONSTANT_ENCAPSED_STRING' ||
				( $token_name === 'T_ENCAPSED_AND_WHITESPACE' && $inside_string )
			) {
				$value = $token[1];
				if ( preg_match( '#\((?!\?P)#', $value ) ) {
					echo "$line";
				}
			}
		} else if ( $token === '"' ) {
			$inside_string = ! $inside_string;
		}
	}
}

fclose( $f );