PPI::Token::HereDoc->heredoc() includes the terminator for quoted terminators

[guillaumeaubert]

While working with @vsespb on guillaumeaubert/Perl-Critic-Policy-ValuesAndExpressions-PreventSQLInjection#14, I discovered that heredoc blocks with a quoted terminator (such as <<"HERE" or <<'HERE') include the terminator line in the output of ->heredoc(), but unquoted heredoc blocks (such as <<HERE) do not.

The issue is the check for the terminator on this line https://github.com/adamkennedy/PPI/blob/master/lib/PPI/Token/HereDoc.pm#L212:

if ( $line eq $terminator ) {

$terminator is the unescaped version of the terminator without surrounding quotes, while the lines that are being compared against will have the escaped version. This also explains why it's not an issue for regular barewords, since for those the escaped and unescaped versions are the same.

I added tests in t/ppi_token_heredoc.t to cover the five possible cases in lib/PPI/Token/HereDoc.pm, and the tests pass after adding the patch in 0295784. The tests are modeled after tests in other t/ppi_token_* files for consistency.

I also opted to add a _raw_terminator key rather than modifying _terminator in the PPI::Token::HereDoc object, in case this would break code that relies on this behavior (even if the key is prefixed with an underscore to indicate that it's private). But this can easily be changed to reuse _terminator if it is preferable.

Thank you for considering this pull request!

[guillaumeaubert]

My mistake, the closing terminator should not include quotes/backticks/etc, or it will not be detected as a valid closing terminator and be included in the heredoc() output instead. So the original code is correct, and I'm closing the pull request accordingly.