vimeo / psalm

A static analysis tool for finding errors in PHP applications
https://psalm.dev
MIT License
5.57k stars 660 forks source link

Possibly invalid dynamic invocations not reported #5286

Open wouterj opened 3 years ago

wouterj commented 3 years ago

https://psalm.dev/r/5eea61068e

Psalm does not seem to check dynamic invocations. The above code doesn't restrict $key, so the method may not exists at all. I think it makes sense if static analysis would catch these cases and I couldn't find such a request already for Psalm (but not sure about internal complexity required for this).

For reference, at least 2 of these invocations are reported by PHPstan: https://phpstan.org/r/ef21ff78-46ca-491c-8870-ed2d09235fa6

psalm-github-bot[bot] commented 3 years ago

I found these snippets:

https://psalm.dev/r/5eea61068e ```php {'get'.$key}(); $v = call_user_func([$period, 'get'.$key]); } ``` ``` Psalm output (using commit bca09d7): INFO: MixedAssignment - 4:5 - Unable to determine the type that $s is being assigned to INFO: MixedAssignment - 5:5 - Unable to determine the type that $t is being assigned to INFO: MixedAssignment - 6:5 - Unable to determine the type that $v is being assigned to INFO: UnusedVariable - 4:5 - $s is never referenced or the value is not used INFO: UnusedVariable - 5:5 - $t is never referenced or the value is not used INFO: UnusedVariable - 6:5 - $v is never referenced or the value is not used INFO: MissingReturnType - 3:10 - Method getSomething does not have a return type, expecting void ```
muglug commented 3 years ago

Yeah, Psalm currently doesn't warn you when calling an unknown methods.

This should probably be reported on level 1 with something like VariableMethodCall or similar.