Comments (1)
@kkmuffme Thanks for opening this issue. That's a nasty one and you do have a point.
Since this is an extremely rare occurrence, most people don't know that this can possibly happen or aren't aware.
I'm not sure the overhead of always requiring addcslashes()
for all preg_replace()
calls containing a variable in the $replacement
parameter is the right solution for something which, by your own admission, will be pretty rare in practice.
I mean, when such a sniff would be used, the only way to "solve" the issue (aside from ignoring it) is to add the function call, even when it is not needed as you know the variable used in safe, which it will probably be in > 95% of all cases.
All in all, I'm not adverse to such a sniff, but I consider it low priority and up for grabs if someone wants to work on it.
Some notes for if/when someone would want to work on this:
- The sniff should only flag
$replacement
parameters containing aT_VARIABLE
token as one of the tokens in the parameter. - The sniff would need to bow out if parameter unpacking is used
preg_replace( $search, ...$otherParams)
. - The sniff would need to take into account that the
$replacement
parameter can either be a string or an array.- If the parameter passed is a variable, whether it is a string or an array cannot be determined (based on the function call alone), so this can be flagged, but most definitely not auto-fixed.
- If the parameter passed is clearly an array (because the array is defined within the parameter), each array entry will need to be examined and, if necessary, flagged individually.
- If the parameter passed/array item is clearly a string, it should be possible to auto-fix this, with a preference for fixing this by wrapping the whole array item/parameter in a function call to
addcslashes()
to prevent potentially having to add the function call multiple times if multiple variables are being concatenated together, though the implementation details ofaddcslashes()
should be checked to be sure this is the right fix.
- The sniff would need to take PHP 8.0 named parameters into account. This will also impact any potential auto-fixers.
- The sniff would need to take a replacement array with keys into account. This will also impact any potential auto-fixers.
So, yes, this sniff will be pretty complex to write.
from phpcsextra.
Related Issues (20)
- Question: what scenarios would using post inc/dec cause issues if code were moved around? HOT 3
- Add the unneeded ternary sniff HOT 1
- Sniff(s) to detect proper usage of preg_quote()
- Sniff to detect the irregular whitespace characters HOT 3
- Sniff to discourage "long" closures
- False positive in Universal.CodeAnalysis.ConstructorDestructorReturn HOT 3
- Incorrect detection of PHP 4-style constructors by Universal.CodeAnalysis.ConstructorDestructorReturn HOT 9
- Sniff to enforce naming conventions for namespace names
- Sniff to enforce naming conventions for class/function/const aliases
- Sniff to detect useless alias names HOT 1
- Sniff to flag `is_a()` and possibly replace with `instanceof`
- Ignore specific keys for Universal.Arrays.MixedArrayKeyTypes and Universal.Arrays.MixedKeyedUnkeyedArray HOT 9
- Universal.Arrays.MixedArrayKeyTypes should report on explicit keys, if implicit keys are the majority HOT 2
- Add option to NormalizedArrays.Arrays.ArrayBraceSpacing to allow single- or multi-line empty arrays HOT 4
- Problem with NormalizedArrays.Arrays.CommaAfterLast in some cases HOT 7
- Feature suggestion: new sniff `EchoConcatenation`
- Potential new sniff: scan code for "Trojan source"
- Feature suggestion: new sniff for detecting brand name or text string HOT 1
- Please add a sniff to format array key => value pairs HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from phpcsextra.