nette / latte

☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.
https://latte.nette.org
Other
1.09k stars 107 forks source link

Statical analysis for Latte [WIP] by MartinMystikJonas #309

Open MartinMystikJonas opened 2 years ago

MartinMystikJonas commented 2 years ago

Continue of work started by @dg in https://github.com/nette/latte/pull/297

MartinMystikJonas commented 2 years ago

@dg: I just discovered unexpected behaviour of {parameters} tag. It limit what variables are available in template. But only at top level (inmain()) but in blocks parameters are always extracted from $this->params therefore unfiltered nad any passed param is available in block no matter what {parameters} defines.

It is bug right? Of is it for some reason expected?

MartinMystikJonas commented 2 years ago

Ok I think I have functional version that passes all tests I used in my previous PR.

I also changed behaviour of {parameters} tag so it also applies inside blocks. Instead of extracting $this->params it now extracts $this->prepare() and adds definition of types used in paramsExtraction (see tags/excpeted/parameters.inc8.phtml)

MartinMystikJonas commented 2 years ago

@dg LEt me know if you want to solve something differently

MartinMystikJonas commented 2 years ago

@dg One think I am not sure of is double meaning of varType. When used in template head it is interpreted as definition of type of parameter (so this type information is propagated inside blocks) and when used outside of head it is interpreted as definition of type of local variable.

I am not sure if this double meaning is ok. Maybe we should make {varType} just about local variables types and add something like {parameterType} to define types of template paramater. What do you think?

MartinMystikJonas commented 1 year ago

@dg @lulco @jakubvojacek @JanTvrdik @mabar Guys, could you check this version and let me know what do you think? I would like to finish this basic version.

lulco commented 1 year ago

Like I wrote somewhere, I'm using https://github.com/revealphp/reveal-src (previously in symplify) for some months maybe year already and it works like a charm for my projects.

MartinMystikJonas commented 1 year ago

@dg Hi. I would like to finish this feature. Is there anything I can do (aside from resolving that new conflict) to have this merged? I do not want to hurry you I just want to know if there is anything I can do.

survilla commented 1 year ago

We have our own PHPStan rule to check link() is valid destination, parameters and parameter types. It is working very nice for PHP code. In latte code we need to be able to recognize the variable type... (The PHPStan rule could be open sourced if anyone interested.

Anyway we would very appreciate to move this PR forward.

MartinMystikJonas commented 1 year ago

@janzimmermannnetrex I would like to see that rule.

survilla commented 1 year ago

@MartinMystikJonas see https://drive.google.com/file/d/1YiJIllqQH3Iyb0rns-rYl2vLX_ro05IN/view?usp=sharing for inspiration. It is definitely not ready to use it as is in another project yet.

MartinMystikJonas commented 11 months ago

@survilla I implemented similar functionality for phpstan-nette with a bit more features and as static-analysis (without actually calling link()). You can check it here if you are interested: https://github.com/phpstan/phpstan-nette/pull/132