Ensure proper escaping of error messages in class-push.php

Escaping functions have been added to all error messages in class-push.php. This change is made to prevent potential Cross-Site Scripting (XSS) vulnerabilities by ensuring any user-supplied data is properly escaped before it is output, following best practices for WordPress development. This does not affect the functionality of the error messages but enhances the security.

admin/apple-actions/index/class-push.php

@@ -147,7 +147,7 @@ private function is_post_in_sync( $json, $meta = [], $bundles = [] ) {
 		// Ensure the post (still) exists. Async operations might result in this function being run against a non-existent post.
 		$post = get_post( $this->id );
 		if ( ! $post ) {
-			throw new \Apple_Actions\Action_Exception( __( 'Apple News Error: Could not find post with id ', 'apple-news' ) . $this->id );
+			throw new \Apple_Actions\Action_Exception( esc_html( __( 'Apple News Error: Could not find post with id ', 'apple-news' ) . $this->id ) );
 		}
 
 		// Compare checksums to determine whether the article is in sync or not.
@@ -187,13 +187,13 @@ private function get() {
 		// Ensure we have a valid ID.
 		$apple_id = get_post_meta( $this->id, 'apple_news_api_id', true );
 		if ( empty( $apple_id ) ) {
-			throw new \Apple_Actions\Action_Exception( __( 'This post does not have a valid Apple News ID, so it cannot be retrieved from the API.', 'apple-news' ) );
+			throw new \Apple_Actions\Action_Exception( esc_html__( 'This post does not have a valid Apple News ID, so it cannot be retrieved from the API.', 'apple-news' ) );
 		}
 
 		// Get the article from the API.
 		$result = $this->get_api()->get_article( $apple_id );
 		if ( empty( $result->data->revision ) ) {
-			throw new \Apple_Actions\Action_Exception( __( 'The Apple News API returned invalid data for this article since the revision is empty.', 'apple-news' ) );
+			throw new \Apple_Actions\Action_Exception( esc_html__( 'The Apple News API returned invalid data for this article since the revision is empty.', 'apple-news' ) );
 		}
 
 		// Update the revision.
@@ -209,7 +209,7 @@ private function get() {
 	 */
 	private function push( $user_id = null ) {
 		if ( ! $this->is_api_configuration_valid() ) {
-			throw new \Apple_Actions\Action_Exception( __( 'Your Apple News API settings seem to be empty. Please fill in the API key, API secret and API channel fields in the plugin configuration page.', 'apple-news' ) );
+			throw new \Apple_Actions\Action_Exception( esc_html__( 'Your Apple News API settings seem to be empty. Please fill in the API key, API secret and API channel fields in the plugin configuration page.', 'apple-news' ) );
 		}
 
 		/**
@@ -227,8 +227,8 @@ private function push( $user_id = null ) {
 			throw new \Apple_Actions\Action_Exception(
 				sprintf(
 					// Translators: Placeholder is a post ID.
-					__( 'Skipped push of article %d due to the apple_news_skip_push filter.', 'apple-news' ),
-					$this->id
+					esc_html__( 'Skipped push of article %d due to the apple_news_skip_push filter.', 'apple-news' ),
+					$this->id // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
 				)
 			);
 		}
@@ -277,8 +277,8 @@ private function push( $user_id = null ) {
 				throw new \Apple_Actions\Action_Exception(
 					sprintf(
 						// Translators: Placeholder is a post ID.
-						__( 'Skipped push of article %d due to the presence of a skip push taxonomy term.', 'apple-news' ),
-						$this->id
+						esc_html__( 'Skipped push of article %d due to the presence of a skip push taxonomy term.', 'apple-news' ),
+						$this->id // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
 					)
 				);
 			}
@@ -393,8 +393,8 @@ private function push( $user_id = null ) {
 			throw new \Apple_Actions\Action_Exception(
 				sprintf(
 					// Translators: Placeholder is a post ID.
-					__( 'Skipped push of article %d to Apple News because it is already in sync.', 'apple-news' ),
-					$this->id
+					esc_html__( 'Skipped push of article %d to Apple News because it is already in sync.', 'apple-news' ),
+					$this->id // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
 				)
 			);
 		}
@@ -451,9 +451,9 @@ private function push( $user_id = null ) {
 			$this->clean_workspace();
 
 			if ( preg_match( '#WRONG_REVISION#', $e->getMessage() ) ) {
-				throw new \Apple_Actions\Action_Exception( __( 'Apple News Error: It seems like the article was updated by another call. If the problem persists, try removing and pushing again.', 'apple-news' ) );
+				throw new \Apple_Actions\Action_Exception( esc_html__( 'Apple News Error: It seems like the article was updated by another call. If the problem persists, try removing and pushing again.', 'apple-news' ) );
 			} else {
-				throw new \Apple_Actions\Action_Exception( __( 'There has been an error with the Apple News API: ', 'apple-news' ) . $e->getMessage() );
+				throw new \Apple_Actions\Action_Exception( esc_html__( 'There has been an error with the Apple News API: ', 'apple-news' ) . esc_html( $e->getMessage() ) );
 			}
 		}
 
@@ -536,7 +536,7 @@ private function process_errors( $errors ) {
 			$this->clean_workspace();
 
 			// Throw an exception.
-			throw new \Apple_Actions\Action_Exception( $alert_message );
+			throw new \Apple_Actions\Action_Exception( esc_html( $alert_message ) );
 		} elseif ( 'warn' === $component_alerts && ! empty( $errors[0]['component_errors'] ) ) {
 				\Admin_Apple_Notice::error( $alert_message, $user_id );
 		}
@@ -590,7 +590,7 @@ private function sanitize_json( $json ) {
 		 */
 		$decoded = json_decode( $json );
 		if ( ! $decoded ) {
-			throw new \Apple_Actions\Action_Exception( __( 'The Apple News JSON is invalid and cannot be published.', 'apple-news' ) );
+			throw new \Apple_Actions\Action_Exception( esc_html__( 'The Apple News JSON is invalid and cannot be published.', 'apple-news' ) );
 		} else {
 			return wp_json_encode( $decoded );
 		}