Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121310
Message-ID: <229c8f26-0090-477c-ad7c-c7a7f8fac659@gmail.com>
Date: Sat, 14 Oct 2023 17:14:20 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: PHP internals <internals@lists.php.net>
References: <0e6ee882-472f-43e1-822e-c156d9048e0c@gmail.com>
 <75d8452e-23ad-4943-b5da-63fdc85c24a0@bastelstu.be>
 <6765d47f-7f6b-436e-b2c9-d98f675905b0@gmail.com>
 <fabdc82f-807e-44fe-a72f-ce31f40e3a85@bastelstu.be>
Content-Language: en-US
In-Reply-To: <fabdc82f-807e-44fe-a72f-ce31f40e3a85@bastelstu.be>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] DOMXPath / XSLTProcessor function callbacks
From: dossche.niels@gmail.com (Niels Dossche)

Hi Tim

On 10/14/23 14:42, Tim Düsterhus wrote:
> Hi
> 
> On 10/14/23 13:54, Niels Dossche wrote:
>>> (a) Call ucfirst(), but not strtoupper()
>>> (b) Call both
>>
>> You can call both, it's additive.
>>
> 
> Okay, for your suggestion (1) the following would work then?
> 
> // Register all native PHP functions.
> $xpath->registerPHPFunctions(null);
> 
> // Register additional callables.
> $xpath->registerPHPFunctions([
>   'staticMethod' => ClassWith::staticMethod(...),
>   'classWithMagicInvoke' => new ClassWithMagicInvoke(),
> ]);

Yes this would work.

> 
> I would not find that usage to be too unreasonable. Especially since allow-listing *all* of PHP's global functions would be pretty questionable (looking at eval() and all functions with side-effects).

That's a fair argument, allowlisting all would indeed be not very defensive programming.
Thanks for your input.

> 
> Best regards
> Tim Düsterhus

Cheers
Niels