Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115311
To: internals@lists.php.net
References: <CAFv4g+HRHrvCOTgpbVfCXj06De1kL+1+RwnGgq6tcyLNAtLfQA@mail.gmail.com>
 <CAFPFaMJs7qvko=tfBsXuwCqMV3VqXL4TjO2aKWWPjrAicZzM9w@mail.gmail.com>
Message-ID: <782e08f6-d6a1-e1e7-b2d6-4706277a4d86@gmail.com>
Date: Tue, 6 Jul 2021 09:32:06 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.11.0
MIME-Version: 1.0
In-Reply-To: <CAFPFaMJs7qvko=tfBsXuwCqMV3VqXL4TjO2aKWWPjrAicZzM9w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-GB
Subject: Re: [PHP-DEV] [RFC] [VOTE] is_literal
From: rowan.collins@gmail.com (Rowan Tommins)

On 06/07/2021 07:38, G. P. B. wrote:
> This is I think the main issue with the current shape of the proposal.
> This implementation will detect certain security issues, but finding the
> root cause for them is going to be rather complicated, as the concatenation
> operation is basically kicking the can down the road about the
> responsibility of checking whether or not the result is a literal.
> Whereas using a function like concat_literal() which checks that the inputs
> are indeed literals provides immediate feedback that the type constraint is
> not being violated.


I still don't follow this reasoning, for the reasons I outlined here: 
https://externals.io/message/114835#114868 and again later: 
https://externals.io/message/115037#115156

You can write your own concat_literal() function with the current 
implementation:

function concat_literal(string $a, string $b): string {
    if( ! is_literal($a) || ! is_literal($b) ) {
         throw new TypeError;
    }
    return $a . $b;
}

This does everything a native version would, and can be used in all the 
same places.

What it won't do, is tell you when you've forgotten to use it, and used 
the normal string concatenation operator - but nor would a built-in 
implementation.

Whether "$foo . $bar" is always non-literal, or non-literal only if one 
of its operands is, you're going to get an error about a non-literal 
string somewhere else in the program, and have to trace back to find 
where the "bad" concatenation happened.

Regards,

-- 
Rowan Tommins
[IMSoP]