Add phpcs.xml for safe output functions

[GaryJones]

There are a at least a couple of functions (build_sorter(), build_filter()) that are deemed safe for output, which are marked with a // WPCS: XSS ok; at the end of the line.

A cleaner approach, would be to add in a phpcs.xml file that defines exactly which code standards are being followed, but also allow the defining of safe functions. Here's an example phpcs.xml that I have for a client theme, that shows the Genesis Framework function genesis_attr() does not need escaping:

<?xml version="1.0"?>
<ruleset name="My Client's Theme">
    <description>The code standard for My Client's theme.</description>
    <file>theme/.</file>
    <arg name="extensions" value="php"/>
    <arg name="report-full" value="logs/phpcs-full.log"/>
    <arg name="report-summary" value="logs/phpcs-summary.log"/>
    <arg name="report-source" value="logs/phpcs-source.log"/>
    <arg name="report-info" value="logs/phpcs-info.log"/>
    <arg name="report" value="summary"/>
    <arg name="report" value="source"/>
    <arg value="sp"/>
    <rule ref="WordPress.XSS.EscapeOutput">
        <properties>
            <property type="array" name="customAutoEscapedFunctions" value="genesis_attr"/>
        </properties>
    </rule>
    <rule ref="WordPress">
        <exclude name="WordPress.VIP"/>
    </rule>
</ruleset>

Adapt that to QM, and all of the relevant inline WPCS XSS comments can be removed.

[johnbillion]

This is blocked by WordPress/WordPress-Coding-Standards#413

[johnbillion]

Closing this off as there's been no movement on the PHPCS issue that blocks this and I'm happy enough with the inline comments in the meantime.

[GaryJones]

The old WPCS-style whitelist comments were deprecated for WPCS 2.0, and a Warning was introduced if they were found (instead of using the PHPCS native ignore comments instead), so I'm curious why these don't seem to be flagged in your CI run.

[johnbillion]

I've got the -n flag in here:

query-monitor/composer.json

Lines 53 to 54 in c86893e

	"phpcs -nps --colors --report-code --report-width=80 --cache=tests/cache/phpcs --basepath='./' --standard=phpcs53.xml",
	"phpcs -nps --colors --report-code --report-width=80 --cache=tests/cache/phpcs --basepath='./' ."