False positive: sanitize_html_class() incorrectly flagged for missing unslash

Bug Description

When using sanitize_html_class() to sanitize an HTML class, PHP_CodeSniffer reports that the passed variable is not unslashed before sanitization. However, sanitize_html_class() strips the string down to A-Z, a-z, 0-9, _, and - (code reference), and therefore it should be listed as an unslashing sanitizing function, similar to sanitize_key(). Instead, it is currently listed as a general sanitizing function.

Minimal Code Snippet

The issue happens when running this command:

phpcs --standard=WordPress --sniffs=WordPress.Security.ValidatedSanitizedInput test.php

... over a file containing this code:

if (! isset($_GET['html_class']) || ! is_string($_GET['html_class'])) {
	return;
}

$htmlClass = sanitize_html_class($_GET['html_class']);

Error Code

WordPress.Security.ValidatedSanitizedInput.MissingUnslash

Environment

Tested Against develop Branch?

• I have verified the issue still exists in the develop branch of WordPressCS.

Start in WordPress/Helpers/SanitizationHelperTrait.php, comparing the unslashing sanitizing functions near lines 139-149 with the general sanitizing functions near line 94. Reproduce the report with the provided phpcs command and PHP snippet. Done means sanitize_html_class() no longer triggers WordPress.Security.ValidatedSanitizedInput.MissingUnslash.