Bug Description

The above sniff is extremely prone to false positives, as it just checks for action/src/href, but should be at least be more specific for action.

Minimal Code Snippet

<input data-action="<?php echo esc_attr( $my_var ); ?>">

or:
'https://demo.com?foo=bar&my-action='<?php echo esc_attr( $var ); ?>

Error Code

Wrong escaping function. href, src, and action attributes should be escaped by esc_url(), not by esc_attr().
WordPressVIPMinimum.Security.ProperEscapingFunction.hrefSrcEscUrl

Environment

Use php -v and composer show to get versions.

Tested Against master branch?

• I have verified the issue still exists in the master branch of VIPCS.
• I have verified the issue still exists in the develop branch of VIPCS.