WordPress/Sniff.php
protected function has_whitelist_comment( $comment, $stackPtr ) {

		// Respect the PHPCS 3.x --ignore-annotations setting.
		if ( true === PHPCSHelper::ignore_annotations( $this->phpcsFile ) ) {
			return false;
		}

		static $thrown_notices = array();

		$deprecation_notice = 'Using the WPCS native whitelist comments is deprecated. Please use the PHPCS native "phpcs:ignore Standard.Category.SniffName.ErrorCode" annotations instead. Found: %s';
		$deprecation_code   = 'DeprecatedWhitelistCommentFound';
		$filename           = $this->phpcsFile->getFileName();

		$regex = '#\b' . preg_quote( $comment, '#' ) . '\b#i';

		// There is a findEndOfStatement() method, but it considers more tokens than
		// we need to consider here.
		$end_of_statement = $this->phpcsFile->findNext( array( \T_CLOSE_TAG, \T_SEMICOLON ), $stackPtr );

		if ( false !== $end_of_statement ) {
			// If the statement was ended by a semicolon, check if there is a whitelist comment directly after it.
			if ( \T_SEMICOLON === $this->tokens[ $end_of_statement ]['code'] ) {
				$lastPtr = $this->phpcsFile->findNext( \T_WHITESPACE, ( $end_of_statement + 1 ), null, true );
			} elseif ( \T_CLOSE_TAG === $this->tokens[ $end_of_statement ]['code'] ) {
				// If the semicolon was left out and it was terminated by an ending tag, we need to look backwards.
				$lastPtr = $this->phpcsFile->findPrevious( \T_WHITESPACE, ( $end_of_statement - 1 ), null, true );
			}

			if ( ( \T_COMMENT === $this->tokens[ $lastPtr ]['code']
					|| ( isset( Tokens::$phpcsCommentTokens[ $this->tokens[ $lastPtr ]['code'] ] )
					&& \T_PHPCS_SET !== $this->tokens[ $lastPtr ]['code'] ) )
				&& $this->tokens[ $lastPtr ]['line'] === $this->tokens[ $end_of_statement ]['line']
				&& preg_match( $regex, $this->tokens[ $lastPtr ]['content'] ) === 1
			) {
				if ( isset( $thrown_notices[ $filename ][ $lastPtr ] ) === false
					&& isset( Tokens::$phpcsCommentTokens[ $this->tokens[ $lastPtr ]['code'] ] ) === false
				) {
					$this->phpcsFile->addWarning(
						$deprecation_notice,
						$lastPtr,
						$deprecation_code,
						array( $this->tokens[ $lastPtr ]['content'] )
					);

					$thrown_notices[ $filename ][ $lastPtr ] = true;
				}

				return true;
			}
		}

		// No whitelist comment found so far. Check at the end of the stackPtr line.
		// Note: a T_COMMENT includes the new line character, so may be the last token on the line!
		$end_of_line = $this->get_last_ptr_on_line( $stackPtr );
		$lastPtr     = $this->phpcsFile->findPrevious( \T_WHITESPACE, $end_of_line, null, true );

		if ( ( \T_COMMENT === $this->tokens[ $lastPtr ]['code']
				|| ( isset( Tokens::$phpcsCommentTokens[ $this->tokens[ $lastPtr ]['code'] ] )
				&& \T_PHPCS_SET !== $this->tokens[ $lastPtr ]['code'] ) )
			&& $this->tokens[ $lastPtr ]['line'] === $this->tokens[ $stackPtr ]['line']
			&& preg_match( $regex, $this->tokens[ $lastPtr ]['content'] ) === 1
		) {
			if ( isset( $thrown_notices[ $filename ][ $lastPtr ] ) === false
				&& isset( Tokens::$phpcsCommentTokens[ $this->tokens[ $lastPtr ]['code'] ] ) === false
			) {
				$this->phpcsFile->addWarning(
					$deprecation_notice,
					$lastPtr,
					$deprecation_code,
					array( $this->tokens[ $lastPtr ]['content'] )
				);

				$thrown_notices[ $filename ][ $lastPtr ] = true;
			}

			return true;
		}

		return false;
	}
protected function has_whitelist_comment( $comment, $stackPtr ) {

		// Respect the PHPCS 3.x --ignore-annotations setting.
		if ( true === PHPCSHelper::ignore_annotations( $this->phpcsFile ) ) {
			return false;
		}

		static $thrown_notices = array();

		$deprecation_notice = 'Using the WPCS native whitelist comments is deprecated. Please use the PHPCS native "phpcs:ignore Standard.Category.SniffName.ErrorCode" annotations instead. Found: %s';
		$deprecation_code   = 'DeprecatedWhitelistCommentFound';
		$filename           = $this->phpcsFile->getFileName();

		$regex = '#\b' . preg_quote( $comment, '#' ) . '\b#i';

		// There is a findEndOfStatement() method, but it considers more tokens than
		// we need to consider here.
		$end_of_statement = $this->phpcsFile->findNext( array( \T_CLOSE_TAG, \T_SEMICOLON ), $stackPtr );

		if ( false !== $end_of_statement ) {
			// If the statement was ended by a semicolon, check if there is a whitelist comment directly after it.
			if ( \T_SEMICOLON === $this->tokens[ $end_of_statement ]['code'] ) {
				$lastPtr = $this->phpcsFile->findNext( \T_WHITESPACE, ( $end_of_statement + 1 ), null, true );
			} elseif ( \T_CLOSE_TAG === $this->tokens[ $end_of_statement ]['code'] ) {
				// If the semicolon was left out and it was terminated by an ending tag, we need to look backwards.
				$lastPtr = $this->phpcsFile->findPrevious( \T_WHITESPACE, ( $end_of_statement - 1 ), null, true );
			}

			if ( ( \T_COMMENT === $this->tokens[ $lastPtr ]['code']
					|| ( isset( Tokens::$phpcsCommentTokens[ $this->tokens[ $lastPtr ]['code'] ] )
					&& \T_PHPCS_SET !== $this->tokens[ $lastPtr ]['code'] ) )
				&& $this->tokens[ $lastPtr ]['line'] === $this->tokens[ $end_of_statement ]['line']
				&& preg_match( $regex, $this->tokens[ $lastPtr ]['content'] ) === 1
			) {
				if ( isset( $thrown_notices[ $filename ][ $lastPtr ] ) === false
					&& isset( Tokens::$phpcsCommentTokens[ $this->tokens[ $lastPtr ]['code'] ] ) === false
				) {
					$this->phpcsFile->addWarning(
						$deprecation_notice,
						$lastPtr,
						$deprecation_code,
						array( $this->tokens[ $lastPtr ]['content'] )
					);

					$thrown_notices[ $filename ][ $lastPtr ] = true;
				}

				return true;
			}
		}

		// No whitelist comment found so far. Check at the end of the stackPtr line.
		// Note: a T_COMMENT includes the new line character, so may be the last token on the line!
		$end_of_line = $this->get_last_ptr_on_line( $stackPtr );
		$lastPtr     = $this->phpcsFile->findPrevious( \T_WHITESPACE, $end_of_line, null, true );

		if ( ( \T_COMMENT === $this->tokens[ $lastPtr ]['code']
				|| ( isset( Tokens::$phpcsCommentTokens[ $this->tokens[ $lastPtr ]['code'] ] )
				&& \T_PHPCS_SET !== $this->tokens[ $lastPtr ]['code'] ) )
			&& $this->tokens[ $lastPtr ]['line'] === $this->tokens[ $stackPtr ]['line']
			&& preg_match( $regex, $this->tokens[ $lastPtr ]['content'] ) === 1
		) {
			if ( isset( $thrown_notices[ $filename ][ $lastPtr ] ) === false
				&& isset( Tokens::$phpcsCommentTokens[ $this->tokens[ $lastPtr ]['code'] ] ) === false
			) {
				$this->phpcsFile->addWarning(
					$deprecation_notice,
					$lastPtr,
					$deprecation_code,
					array( $this->tokens[ $lastPtr ]['content'] )
				);

				$thrown_notices[ $filename ][ $lastPtr ] = true;
			}

			return true;
		}

		return false;
	}
Find whitelisting comment.

Comment must be at the end of the line or at the end of the statement
and must use // format.
It can be prefixed or suffixed with anything e.g. "foobar" will match:
... // foobar okay
... // WPCS: foobar whitelist.

There is an exception, and that is when PHP is being interspersed with HTML.
In that case, the comment should always come at the end of the statement (right
before the closing tag, ?>). For example:

<input type="text" id="<?php echo $id; // XSS OK ?>" />

@since 0.4.0
@since 0.14.0 Whitelist comments at the end of the statement are now also accepted.

@deprecated 2.0.0 Use the PHPCS native `phpcs:ignore` annotations instead.

@param string  $comment  Comment to find.
@param integer $stackPtr The position of the current token in the stack passed
in $tokens.

@return boolean True if whitelisting comment was found, false otherwise.