Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107863
MIME-Version: 1.0
References: <CAAupm8h5Aa4EmnGnHX1iVgcQTCpmW-3yD4e6m7aouZFiSCtGrA@mail.gmail.com>
 <CAN=NbAK6GOEqMSkc=PiiopHpX=zebzZwX=pxqvf+uHqc6CkNEQ@mail.gmail.com>
In-Reply-To: <CAN=NbAK6GOEqMSkc=PiiopHpX=zebzZwX=pxqvf+uHqc6CkNEQ@mail.gmail.com>
Date: Tue, 26 Nov 2019 10:15:58 -0600
Message-ID: <CAAupm8iYH4JuF8CkygSqRwcjDzjSZgDudz5iHz3xP3=hTqXKJA@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary="000000000000b5ab0c05984232a1"
Subject: Re: [PHP-DEV] Let's allow eval() to be turned off in PHP 8
From: iansltx@gmail.com (Ian Littman)

--000000000000b5ab0c05984232a1
Content-Type: text/plain; charset="UTF-8"

Looks like PHPUnit only uses eval() for mock objects, and Twig only uses it
as a last line of defense for building templates. Still breakages, but not
of the entire packages (at least those packages) from what I can see.

That said, I agree that eval() should stay enabled by default, as too much
breaks if we did the opposite. That way, folks can opt into a hardened
environment (at least in this respect) once they've determined that doing
so won't break their software.

On Tue, Nov 26, 2019 at 10:01 AM Ken Stanley <dohpaz@gmail.com> wrote:

>
> So long as the default behavior is to leave it available, I'm okay with
> this. Any app
> that relies on twig/twig, phpunit/phpunit, many symfony packages,
> dompdf/dompdf,
> etc relies on being able to use eval().
>

--000000000000b5ab0c05984232a1--