"Error: Expected next thing to be an escaping function..."

[philiparthurmoore]

Consider the following code, which will output the published (and updated) time for a post:

        // post time
        if ( in_array( get_post_type(), array( 'post', 'attachment' ) ) ) {
            $time_string = '<time class="entry-date published updated" datetime="%1$s">%2$s</time>';
            if ( get_the_time( 'U' ) !== get_the_modified_time( 'U' ) ) {
                $time_string = '<time class="entry-date published" datetime="%1$s">%2$s</time><time class="updated" datetime="%3$s">%4$s</time>';
            }
            $time_string = sprintf(
                $time_string,
                esc_attr( get_the_date( 'c' ) ),          // %1$s
                esc_html( get_the_date() ),               // %2$s
                esc_attr( get_the_modified_date( 'c' ) ), // %3$s
                esc_html( get_the_modified_date() )       // %4$s
            );
            printf(
                '<span class="posted-on">%1$s<a href="%2$s" rel="bookmark">%3$s</a></span>',
                wp_kses_post( _x( '<span class="screen-reader-text">Posted on</span>', 'Used before publish date.', 'theme-slug' ) ),
                esc_url( get_permalink() ),
                $time_string
            );
        }

WordPress Coding Standards are reporting that $time_string should be escaped, but esc_html, esc_attr, wp_kses_post, or wp_kses (with allowed tags) aren't practical. Is there any way to get around this (I think) false error, without introducing too much convoluted code into the theme that I'm working on? Note that this also affects Twenty Fifteen and _s, which I'm working on getting up to date with all coding standards.

[JDGrimes]

You can ignore a specific error with a whitelisting comment like this:

            printf( // WPCS: XSS OK
                '<span class="posted-on">%1$s<a href="%2$s" rel="bookmark">%3$s</a></span>',
                wp_kses_post( _x( '<span class="screen-reader-text">Posted on</span>', 'Used before publish date.', 'theme-slug' ) ),
                esc_url( get_permalink() ),
                $time_string
            );

[philiparthurmoore]

Fantastic. This works a treat.