Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:101309 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 26942 invoked from network); 11 Dec 2017 08:05:23 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 11 Dec 2017 08:05:23 -0000 Authentication-Results: pb1.pair.com header.from=ocramius@gmail.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=ocramius@gmail.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.182 as permitted sender) X-PHP-List-Original-Sender: ocramius@gmail.com X-Host-Fingerprint: 209.85.128.182 mail-wr0-f182.google.com Received: from [209.85.128.182] ([209.85.128.182:36193] helo=mail-wr0-f182.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id BD/28-53433-14C3E2A5 for ; Mon, 11 Dec 2017 03:05:23 -0500 Received: by mail-wr0-f182.google.com with SMTP id v105so16524160wrc.3 for ; Mon, 11 Dec 2017 00:05:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=9lh8eFcTlpNNEaBvvyT6/+/zG5wfqiHBrcCKOFQ5tK8=; b=EOdLkrgpR9BFPZvpqeH8CaLOIs69TWdrYCW3DLvhluPBTCzdE4ONGTGM/CCw4kVZ+r W0J0ilTuYkk8uaDvjsIsACdZ4DSWwfaJ50y8kpsN5WCXoItDidy8pxAaw9UsH8Hxg1Sw LgfJs0jfSDY2emlOA6kVgnEDB8fynlm5RVnztPff2TkXtMm3TwVNbWMUChjSx4qPNNax eze+T8oLCdlHvqL2QN0R5TYvVz8HUMRVRJ3jc9RUe6b+8clA8K9hn6c29ouo5kwmfbq+ WONu1IYtGYKO6a/+L7sCRY35CIT03eL6fk/375dRIDpyu3gmpP8OHZqXJvL0tFGUoyip K75w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=9lh8eFcTlpNNEaBvvyT6/+/zG5wfqiHBrcCKOFQ5tK8=; b=exZ4d9jEc6evZKR2X+LTZ/FF2bmY5Yfsmr22lyASzUk5Txx1SZcttaV59U/KBN9DMc twzjjB0VO5bqVwxuVQCIas0L2JSROUKq4LImd0AphyItqLgx7lht7Uk5T+t6ulufwtP5 iSxeaZR9iT7jT1Tl96TKOCgS1ywg4uMruvF8D9zGZaTsLf/VZejR4umLzEdImjObE8yH vLoZQfkjIPGe0aeSIHUTNcTuwR/p9LAA2pbQg3kdJcXade7NnrukG9tE0fwas1lOvsvI QZrfEmsD+SXjz2Cyeds4SHg0aiMKefkrK4FWnCjPvPQo4js6G+hGsPk+xKVPgpo5fMDj 6JZA== X-Gm-Message-State: AJaThX5PYfMoMLxJO4beObtEGNPQV8yufv1eweN6HjiRh5kjvEk+mJXi SLX48w9U0SG4oqDmE0IiT1SVoguMGMiwYP1qrjE= X-Google-Smtp-Source: AGs4zMZVUSCTUyJRcJb3ogbRqjicelo7RwGcT5gUyLbJ5GYBxhbgnFtRIX4gFhyFB8vuUDsqCALd7xKKSVr6/iqIwPc= X-Received: by 10.223.131.70 with SMTP id 64mr31695148wrd.114.1512979519411; Mon, 11 Dec 2017 00:05:19 -0800 (PST) MIME-Version: 1.0 Received: by 10.223.184.205 with HTTP; Mon, 11 Dec 2017 00:05:18 -0800 (PST) Received: by 10.223.184.205 with HTTP; Mon, 11 Dec 2017 00:05:18 -0800 (PST) In-Reply-To: References: Date: Mon, 11 Dec 2017 09:05:18 +0100 Message-ID: To: Andreas Hennings Cc: Niklas Keller , PHP Internals List Content-Type: multipart/alternative; boundary="94eb2c0d2476ce9a9505600bfefd" Subject: Re: [PHP-DEV] ReflectionContext for imports and namespace From: ocramius@gmail.com (Marco Pivetta) --94eb2c0d2476ce9a9505600bfefd Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On 11 December 2017 at 08:46, Marco Pivetta wrote: > Indeed that already exists at > https://github.com/Roave/BetterReflection/blob/2.0.1/ docs/features.md#analysing-types-from-docblocks > - relatively new lib, so it probably didn't get noticed upfront in here. Yes, parser / userland solutions exist for this purpose. (I have seen BetterReflection) I just thought since this information is already available, a library that uses reflection API should not need a userland parser to get it. Unless the codebase being analyzed is trusted and not legacy (wordpress-style) any tool based on the current reflection API is basically a potential security issue or a set of potentially harmful side-effects. The reason for me and James building BetterReflection was essentially that, since the current API is flawed and not really fixable without BC breaks (removing the side-effect), so I strongly encourage any code analysis tool to just use the userland adapters we wrote, and only switch to core reflection when performance is more critical than security. This also means that if your addition makes it into the language it will be implemented also by those adapters BTW, so push on =F0=9F=91=8D --94eb2c0d2476ce9a9505600bfefd--