php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #64185 is_callable does not check syntax
Submitted: 2013-02-10 16:04 UTC Modified: 2013-02-13 19:52 UTC
From: hanskrentel at yahoo dot de Assigned:
Status: Wont fix Package: Scripting Engine problem
PHP Version: 5.4.11 OS:
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: hanskrentel at yahoo dot de
New email:
PHP Version: OS:

 

 [2013-02-10 16:04 UTC] hanskrentel at yahoo dot de
Description:
------------
Using is_callable with the syntax_only parameter set to true does actually *not* 
check the syntax, for example of a valid classname or FQCN.

Also not for the method name.

My feature request is, that it will always check those strings according to the 
rules set in the PHP parser of the same PHP version the function ships with so 
that it can be used to validate PHP syntax as well.

Same for calls with :: for static class name method calls.

Test script:
---------------
var_dump(is_callable(['', ''], true));
var_dump(is_callable(['', 'method'], true));
var_dump(is_callable(['0', 'method'], true));
var_dump(is_callable(['0\\foo', 'method'], true));
var_dump(is_callable(['\\0\\foo', 'method'], true));

Expected result:
----------------
bool(false)
bool(false)
bool(false)
bool(false)
bool(false)

Actual result:
--------------
bool(true)
bool(true)
bool(true)
bool(true)
bool(true)

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2013-02-10 17:04 UTC] hanskrentel at yahoo dot de
NikiC was so friendly to just remind me that checking for the method name *is* limited because of __call and __callStatic (basically everything for a method name works, including a zero-length string).

So this feature request is actually more about the classname validation then the method name validation.
 [2013-02-13 14:40 UTC] johannes@php.net
Even with classes such names could - theoretically - exist due to weird (3rd party) extensions etc. (i hope nobody does, but there's nothing stopping one)

So "syntax" in this case does not mean "one could use those names in syntactically correct PHP code" but "the overall structure matches something that might be used in a lookup"
 [2013-02-13 19:52 UTC] nikic@php.net
Agree with what johannes said, marking as wontfix.
 [2013-02-13 19:52 UTC] nikic@php.net
-Status: Open +Status: Wont fix
 [2013-05-11 10:01 UTC] nikic@php.net
I just remembered that as of 5.4 you can actually create classes with arbitrary names from userland using class_alias. So that makes the second point moot too.
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Fri Dec 06 00:01:23 2019 UTC