Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101313
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH0Uv3Ebvg+Jpgn9hkNw+ScatjKvKz3wRGpM7SbHVkX+KGS1nA@mail.gmail.com>
References: <CAH0Uv3ErvVo5qPotvrHby7AKrzUQix_YuDU5dbQWos8bvCASqw@mail.gmail.com>
 <CANUQDChCkt0CzYHeJoRN+d7_wWBe82-J5MJEgXWFj9qTBMz4Zg@mail.gmail.com>
 <CAH0Uv3FNGUTtUKx8SA=VJ2MKUQmdt1Rd0vqQXCZt_zk3n6tqQA@mail.gmail.com>
 <CADyq6sJ4SBPTbnwQo+5Qzna_jM8chuurqDGFK8ucNW63VdUQ_g@mail.gmail.com> <CAH0Uv3Ebvg+Jpgn9hkNw+ScatjKvKz3wRGpM7SbHVkX+KGS1nA@mail.gmail.com>
Date: Mon, 11 Dec 2017 09:18:19 +0100
Message-ID: <CADyq6sKjNYu2PN1PheFeZ=Jv4Q_1Vkcc4wH9yV4+iYoTYpPLLQ@mail.gmail.com>
To: Andreas Hennings <andreas@dqxtech.net>
Cc: Niklas Keller <me@kelunik.com>, PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a114cc6c459af7b05600c2d44"
Subject: Re: [PHP-DEV] ReflectionContext for imports and namespace
From: ocramius@gmail.com (Marco Pivetta)

--001a114cc6c459af7b05600c2d44
Content-Type: text/plain; charset="UTF-8"

On 11 Dec 2017 09:10, "Andreas Hennings" <andreas@dqxtech.net> wrote:



On 11 December 2017 at 09:05, Marco Pivetta <ocramius@gmail.com> wrote:

> On 11 December 2017 at 08:46, Marco Pivetta <ocramius@gmail.com> wrote:
> > Indeed that already exists at
> > https://github.com/Roave/BetterReflection/blob/2.0.1/docs/fe
> atures.md#analysing-types-from-docblocks
> > - relatively new lib, so it probably didn't get noticed upfront in here.
>
>
> Yes, parser / userland solutions exist for this purpose.
> (I have seen BetterReflection)
>
> I just thought since this information is already available, a library
> that uses reflection API should not need a userland parser to get it.
>
>
> Unless the codebase being analyzed is trusted and not legacy
> (wordpress-style) any tool based on the current reflection API is basically
> a potential security issue or a set of potentially harmful side-effects.
> The reason for me and James building BetterReflection was essentially that,
> since the current API is flawed and not really fixable without BC breaks
> (removing the side-effect), so I strongly encourage any code analysis tool
> to just use the userland adapters we wrote, and only switch to core
> reflection when performance is more critical than security.
>

These side effects would be that the class loader loads files which can
break things?


Yes. Reflecting over a codebase which contains even just polyfills
(duplicate classes) can already lead to unexpected crashes. Reflecting over
non-PSR-2 code can even lead to worse things such as starting a DB
connection and performing unwanted operations.

--001a114cc6c459af7b05600c2d44--