PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage false positive for non-attachments

[kkmuffme]

When the src uses plugins_url() (or probably any code that doesn't contain the WP "UPLOADS" constant) it shouldn't report an error.
e.g.

$text .= '<img src="' . esc_url( plugins_url( 'assets/images/paypal.png', __FILE__ ) ) . '" width="50" alt="PayPal">';

[swissspidy]

Sounds like a duplicate of #757 and #831.

We already changed the severity to a warning because there can always be false positives with such a static analysis check.

If there's too much noise over time we can reconsider improving or sunsetting the check though.

[dd32]

IMHO this check should be either removed, or made much smarter. Even just checking to see if the src attribute appears to be using plugins_url() or similar function and ignoring it in that case.

The only place where this check as it currently stands makes sense is for theme authors, although it'd be possible for a plugin to improperly output images for templates, this particular sniff triggers for almost literally every plugin with a false positive.

[ernilambar]

I will work on removing it.