Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115935
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\))
Date: Fri, 3 Sep 2021 18:02:04 +0200
References: <CADJ56BRPi_GHE7R70k-NdgQ6ea2ogLSe6Z6Eg-YGKpeYSmvhbQ@mail.gmail.com>
 <CAJvSBVP2pCT6wDNrpVDp=1_JQtrG=H2Y2fy8L-vcvgawhWstCw@mail.gmail.com>
 <CADJ56BSHDTZ86oRqMHfsB860WXsO3ORv7JVGArJx+Q7FN4nD5g@mail.gmail.com>
 <0A048A30-444F-4DB0-A79C-9EA9BD07B1EC@cschneid.com>
 <CADJ56BT=TDF2_fn5ci-=34cuMSeks5NzA4r5_5acVNum9PY_kw@mail.gmail.com>
 <CAF+90c-qjOvu6UefGGba2NdRkhRovWq1sUCOfs6+Odt1eLJm+Q@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
In-Reply-To: <CAF+90c-qjOvu6UefGGba2NdRkhRovWq1sUCOfs6+Odt1eLJm+Q@mail.gmail.com>
Message-ID: <569E3A48-E3F5-46FA-BA08-D2493CE4FD33@cschneid.com>
Subject: Re: [PHP-DEV] Adding a way to disable the stat cache
From: cschneid@cschneid.com (Christian Schneider)

Am 03.09.2021 um 17:23 schrieb Nikita Popov <nikita.ppv@gmail.com>:
> Just to throw it out there: Maybe we should clear the stat cache when =
functions in the exec family are used? Even if we allow disabling the =
stat cache, I think we can easily avoid that particular footgun. And if =
calls to external binaries are involved we likely don't have to worry =
about stat overhead.

While this would make the foot gun a bit smaller it introduces more =
magic. I'm not completely against it but it feels dirty.
On top of that: I hope people using exec and friends are properly =
escaping parameters. Which in our case is a helper function where a =
clear_stat_cache() could easily be added in user land, making it =
explicit.

Side-note: We should teach people not to use exec style function when =
normal PHP functions work :-)
The following works fine:

<?php

touch("foo");
if (is_file('foo'))
    echo "Correct\n";

unlink("foo");
if (is_file('foo'))
    echo "Incorrect\n";

Sure, it was a contrived example but external programs should IMHO be =
avoided if (easily enough) possible.

But going back to the original topic: After thinking about it I'd rather =
completely remove the stat cache (after properly evaluating the impact) =
than adding a new mode to PHP. At least the behavior would then be a =
function of the PHP version, not the PHP version *and* an ini setting.

- Chris