How to supply a list of forbidden functions (Generic.PHP.ForbiddenFunctions)

[travispaul]

I can't figure out how to provide a custom list of forbidden functions. I'm not sure if it's even possible, given that the $forbiddenFunctions property is protected. But the doc block says: "Can be used to forbid the use of any function." so perhaps I'm just doing something wrong.

I am using the following command:

$ phpcs -l -p src\lib --extensions=php --standard=phpcs.xml

And phpcs.xml looks like this:

<?xml version="1.0"?>
<ruleset name="Custom Standard">
    <description>Test Coding Standard</description>

    <rule ref="Generic.PHP.ForbiddenFunctions">
        <properties>
            <property name="forbiddenFunctionNames" type="array" value="eval,system,phpinfo"/>
        </properties>
    </rule>

</ruleset>

The error message is:

PHP Fatal error:  Cannot access protected property Generic_Sniffs_PHP_ForbiddenFunctionsSniff::$forbiddenFunctionNames

[gsherwood]

You can only override public properties in a ruleset.xml file. The ForbiddenFunctions sniff does not yet allow this, so you'd have to write a custom sniff to override it. Here is an example: https://github.com/squizlabs/PHP_CodeSniffer/blob/master/CodeSniffer/Standards/Squiz/Sniffs/PHP/ForbiddenFunctionsSniff.php

I'll keep this here as a feature request because it should be fairly easy to add.

[floriant]

Is there more to it?
I wrote my own Standard according to the Tutorial.
I cloned the Code from the Squiz Standard and changed the Class names according to my Structure. Now I try to extend the forbiddenFunctions Array with my own restrictions. But for some Reason it wont detect any of my Rules.

To verify the File is loaded properly I changed the key of 'is_null' to 'is_nulll'.
My testscript had detected the is_null before, and after the Verification it isnt anymore. I assume its the right File then.

I just wrote the rules for Testing:

protected $forbiddenFunctions = array(
    'die'             => 'exit',
    'sizeof'          => 'count',
    'delete'          => 'unset',
    'print'           => 'echo',
    'is_null'         => null,
    'create_function' => null,
    'exit'            => null,
);

[gsherwood]

There isn't anything more to it than that.

You can use the -vv command line argument to ensure your custom standard is loading the sniffs properly. You can use -vvv to get a heap of output and check exactly which sniffs are being executed for each token in the file (use a very small file for this, or you will get too much output).

If I was debugging, I'd override the process() method as well and put in some debug information before calling parent::process($phpcsFile, $stackPtr); to check that it is being called.

[floriant]

Ok, with your debugging Advice I was able to understand what the Tokenizer exactly does. :)

I want to Share the source of my Problems in my Example in this Issue:

die() is a Alias for exit().
exit() however is not a function, its Tokenized as T_EXIT
because its Part of the Language itself like "if, else" and so on.

This is why its not Parsed by the register() function, which calls its parent in the Squizlab example.
Code Sniffer only does: return array(T_STRING);
So adding T_EXIT would also enforce the die() alias for exit() to be Noted.

After checking for the needed Token, I can apply this to the register() function with:
return array(T_STRING, T_EXIT);

[gsherwood]

And this is actually why it is not very easy to add, even though I said that above :)

I'd have to tokenize some generated PHP in the register function, with each of the forbidden functions in there (e.g., <?php die(); sizeof(); print(); exit();) and then see what tokens I get from that. Those will be the ones that need to be registered.

[gsherwood]

I've added this feature to the 2.x version (phpcs-fixer branch). Here is an example of how you would set the forbidden functions in your ruleset.xml file (this replicates what the Squiz sniff does that I linked to in a previous comment):

<!-- Forbid some functions -->
<rule ref="Generic.PHP.ForbiddenFunctions">
  <properties>
    <property name="forbiddenFunctions" type="array" value="sizeof=>count,delete=>unset,print=>echo,is_null=>null,create_function=>null"/>
  </properties>
</rule>

[travispaul]

Thanks @gsherwood!

[Torte72]

Thanks for this improvement!
Unfortunately the assignment of null values doesn't work. It just takes "null" as a string which results in in messages like "The use of function is_null() is forbidden, use null() instead".
Could you please add a handling for that?

Thanks!

[aik099]

@Torte72 , this is because it's only how it was proposed in #263 (comment), but @gsherwood 's implementation was different.

So you want just to tell, that function is forbidden with no alternative functions to use?