search

spaze / phpstan-disallowed-calls

PHPStan rules to detect disallowed method & function calls, constant, namespace, attribute & superglobal usages
MIT License
255 stars 17 forks source link

Add create_function as a disallowed function call #261

Closed BackEndTea closed 3 months ago

BackEndTea commented 3 months ago

I doubt this is still used much, since it was removed in PHP 8.0 But if its present you probably want to get rid of it

spaze commented 3 months ago

Yeah, right, even the docs say

This function internally performs an eval() and as such has the same security issues as eval().

So yeah, that function should also be reported, thanks! Now I'm wondering if the rule for the function will ever be triggered but I'm not going to build a telemetry for that 😆

Can you please squash the two commits to one? :-)

spaze commented 3 months ago

Thanks!