Re: Coercive STH - some real world tests and updated RFC

On Fri, Feb 27, 2015 at 2:37 PM, Damien Tournoud <damz@damz.org> wrote: > Hi Zeev, > > On Fri, Feb 27, 2015 at 12:57 AM, Zeev Suraski <zeev@zend.com> wrote: > > > Drupal homepage: One new E_DEPRECATED warning, which seems to catch a > > real bug, or at least faulty looking code: > > $path = trim($path, '/'); // raises E_DEPRECATED, as $path is boolean > > false. > > return $path; > > > > Drupal admin interface (across the all pages): One new E_DEPRECATED > > warning, which again seems to catch a real bug - stripslsahes() operating > > on a boolean. > > > > All those are due to a bug in substr(), that we see now only thanks to > proper type identification. There is no reason for substr() to ever return > a boolean. It really needs to be fix to always return a string. > > Damien > This kind of code here exhibits the failure: https://github.com/pdepend/pdepend/blob/master/src/main/php/PDepend/Source/Language/PHP/PHPTokenizerInternal.php#L584 This is classic PHP style code where you rely on the implicit casting to make the algorithm work for you. if substr() here returns false, then the error is: 1767) PDepend\Source\Parser\UnstructuredCodeTest::testParserHandlesNonPhpCodeInFileProlog strlen() expects parameter 1 to be string, boolean given /home/benny/code/php/workspace/pdepend/src/main/php/PDepend/Source/Language/PHP/PHPTokenizerInternal.php:586 The funny thing is that the fix for this is: - substr($image, strrpos($image, "\n") + 1) + (string)substr($image, strrpos($image, "\n") + 1) Which is that sort of casting that is put forward as argument against the dual/strict mode.