BadFunctions/EasyRFI: efficiency fix

As the tokens to search for don't change during a PHPCS run, it is inefficient to use the "expensive" `array_merge()` function 1) within a `while` loop and 2) every time the sniff is triggered by an include/require token.

The set of tokens to search for can just as easily be set only once before the sniff is ever triggered and doing so will make the sniff faster.

Author: jrfnl

Security/Sniffs/BadFunctions/EasyRFISniff.php

@@ -7,12 +7,24 @@
 
 class EasyRFISniff implements Sniff {
 
+	/**
+	 * Tokens to search for within an include/require statement.
+	 *
+	 * @var array
+	 */
+	private $search = [];
+
 	/**
 	* Returns the token types that this sniff is interested in.
 	*
 	* @return array(int)
 	*/
 	public function register() {
+		// Set the $search property.
+		$this->search  = \PHP_CodeSniffer\Util\Tokens::$emptyTokens;
+		$this->search += \PHP_CodeSniffer\Util\Tokens::$bracketTokens;
+		$this->search += \PHPCS_SecurityAudit\Security\Sniffs\Utils::$staticTokens;
+
 		return array(T_INCLUDE, T_INCLUDE_ONCE, T_REQUIRE, T_REQUIRE_ONCE);
 	}
 
@@ -37,7 +49,7 @@ public function process(File $phpcsFile, $stackPtr) {
 			$s = $stackPtr;
 		}
 		while ($s) {
-			$s = $phpcsFile->findNext(array_merge(\PHP_CodeSniffer\Util\Tokens::$emptyTokens, \PHP_CodeSniffer\Util\Tokens::$bracketTokens, \PHPCS_SecurityAudit\Security\Sniffs\Utils::$staticTokens), $s + 1, $closer, true);
+			$s = $phpcsFile->findNext($this->search, $s + 1, $closer, true);
 			if ($s && $utils::is_token_user_input($tokens[$s])) {
 				if (\PHP_CodeSniffer\Config::getConfigData('ParanoiaMode') || !$utils::is_token_false_positive($tokens[$s], $tokens[$s+2])) {
 					$phpcsFile->addError('Easy RFI detected because of direct user input with ' . $tokens[$s]['content'] . ' on ' . $tokens[$stackPtr]['content'], $s, 'ErrEasyRFI');

Security/Sniffs/Utils.php

@@ -3,7 +3,12 @@
 class Utils {
 
 	// Tokens that can't containts or use any variables (so no user input)
-	public static $staticTokens = array(T_CONSTANT_ENCAPSED_STRING, T_COMMA, T_LNUMBER, T_DNUMBER);
+	public static $staticTokens = array(
+		T_CONSTANT_ENCAPSED_STRING => T_CONSTANT_ENCAPSED_STRING,
+		T_COMMA                    => T_COMMA,
+		T_LNUMBER                  => T_LNUMBER,
+		T_DNUMBER                  => T_DNUMBER,
+	);
 
 	/**
 	* Heavy used function to verify if a string from a token contains user input