vimeo / psalm

A static analysis tool for finding errors in PHP applications
https://psalm.dev
MIT License
5.56k stars 660 forks source link

ext/xml: set_*_handler() functions allows to set relative method names for callables #10249

Open Girgias opened 1 year ago

Girgias commented 1 year ago

While doing some refactoring on ext/xml I discovered that the callable handler parameter has some rather strange semantics, in that it allows to set a method name to be called on the object set via xml_set_object()

Don't know if you want to fix this, but just raising awareness.

https://psalm.dev/r/63bf97a7b9

Related to:

psalm-github-bot[bot] commented 1 year ago

I found these snippets:

https://psalm.dev/r/63bf97a7b9 ```php dummy = "b"; throw new Exception("ex"); } function endHandler($XmlParser, $tag) { } } $p1 = new Xml_Parser(); try { $p1->parse(''); echo "Exception swallowed\n"; } catch (Exception $e) { echo "OK\n"; } ``` ``` Psalm output (using commit 1b12255): ERROR: InvalidClass - 31:11 - Class, interface or enum Xml_Parser has wrong casing ERROR: UnusedFunctionCall - 11:9 - The call to xml_set_object is not used ERROR: UndefinedFunction - 13:42 - Function startHandler does not exist ERROR: UndefinedFunction - 13:58 - Function endHandler does not exist ERROR: UnusedFunctionCall - 13:9 - The call to xml_set_element_handler is not used INFO: MixedArgument - 15:28 - Argument 2 of xml_parse cannot be mixed, expecting string ERROR: UnusedFunctionCall - 15:9 - The call to xml_parse is not used ERROR: UnusedFunctionCall - 17:9 - The call to xml_parser_free is not used INFO: MissingParamType - 7:20 - Parameter $data has no provided type INFO: MissingReturnType - 7:14 - Method XML_Parser::parse does not have a return type, expecting void INFO: MissingParamType - 20:27 - Parameter $XmlParser has no provided type INFO: MissingParamType - 20:39 - Parameter $tag has no provided type INFO: MissingParamType - 20:45 - Parameter $attr has no provided type INFO: MissingReturnType - 20:14 - Method XML_Parser::startHandler does not have a return type, expecting never INFO: MissingParamType - 26:25 - Parameter $XmlParser has no provided type INFO: MissingParamType - 26:37 - Parameter $tag has no provided type INFO: MissingReturnType - 26:14 - Method XML_Parser::endHandler does not have a return type, expecting void INFO: MissingPropertyType - 5:12 - Property XML_Parser::$dummy does not have a declared type - consider string ```