create_function() should be a blocker

[emrikol]

It's currently at a "warning" level:

create_function is discouraged, please use Anonymous functions instead.

[david-binda]

I'm not quite sure whether the Blocker level is appropriate. It is listed as a blocker in https://vip.wordpress.com/documentation/vip/code-review-what-we-look-for/#eval-and-create_function but the message is not that strict:

If there are no other options than to use this construct, pay special attention not to pass any user provided data into it without properly validating it beforehand.

The PHPCS WordPress Coding Standards were fine tuned for the create_function in WordPress/WordPress-Coding-Standards@27ce2f8 which separates the eval from create_function.

If we agree that create_function should be an Error (aka Blocker) and not a Warning, then we should report the issue in the upstream repository.

[rebeccahum]

It's listed as a warning for VIP Go though: https://vip.wordpress.com/documentation/vip-go/code-review-blockers-warnings-notices/#eval-and-create_function so should it remain as a warning for VIP Go and listed as a blocker upstream?

[GaryJones]

As of PHP 7.2, create_function is deprecated and highly discouraged.

For the sake of platform capability, I think this should be marked as an Error.

[rebeccahum]

This appears to be at an error level now:

---

3 | ERROR | create_function() is deprecated as of PHP 7.2.0
| | (WordPressVIPMinimum.Functions.CreateFunction.CreateFunction)

[GaryJones]

This appears to be at an error level now

You're right: addError() is called, and it's not overwritten in either of the rulesets.