« first day (3791 days earlier)      last day (1382 days later) » 
00:00 - 23:0023:00 - 00:00

23:00
So you're getting null instead of array in 8.0?
I think it's the other way around, see cmb's message a bit higher
cmb
cmb
I think using getType() instead of getClass() is plain wrong. You need to actually check whether the type is a class (might be fiddly), and otherwise return NULL.
@FélixGagnon-Grenier yea, a pr with a failing test would be nice.
I haven't contributed to PHP really in years but I just had what might be an awesome idea.
Maybe.
PR it to auryn, I can pull it over to amphp/injector afterward.
23:05
cool, was wondering over which one to choose
@Andrea :-D until you need to construct queries by code
cmb
cmb
Something like 3v4l.org/R3dn1, maybe? (support for union types is exempt; not sure if that could even work)
@bwoebi Yeah. I am thinking it can be an optional PDO thing that a framework can turn on if it is mean/security-conscious.
But we probably can't do it by default, alas ;_;
@Andrea I'm thinking that will break most framework code that inserts table names, etc. from config.
@Trowski Yeah… but it would also encourage creating a safer way to handle that somehow.
@Danack hadn't seen that proposal, but pretty much. I just realised we almost already have the flag for this internally
I am slightly tired and emotional as private eye would say, but think it has to be separate flag as too confusing overloading that.
Yeah I mean, my approach will not work if we ever intern things in other circumstances, or don't intern literals.
SHOW WARNINGS fails when using native prepared statements ・ PDO MySQL ・ #80827
I don't understand wat zend_compile_expr_inner is doing, so got stuck there setting the flag on the strings at what I thought was an appropriate place.
23:14
But it's not bad for an idle thought that required three lines of code to test :p
@Andrea I think that is best solved by coding conventions though, like, inline queries as in ->query("SELECT 1") must not contain variables. And then for the couple times where you need an assembled query, you just apply due diligence.
@Andrea by saying where I was stuck, I might have been asking for help. er, help.
@bwoebi have you watched youtube.com/watch?v=ccfEu-Jj0as&ab_channel=OWASP itincludes a security engineer at google's explanation of why that doesn't work, even with google quality engineers.
And if it doesn't work for google developers ...... gestures in general direction of PHP users.
@Danack haha. If you have some half-working (or not working) code I can take a look tomorrow evening maybe.
7 mins ago, by Danack
code that almost works is here: https://github.com/Danack/php-src/tree/is_literal_attempt_two
it works for one of the tests. but I don't understand what is even happening in zend_compile_expr_inner .
maybe I'll open an issue and ping you with it.
OK, I'll try to remember.
@bwoebi No amount of conventions will stop people being silly, is the thing…
23:25
lol. so er, auryn uses phpunit 4.something. phpunit 4.something uses the function each. that function is deprecated in 8.0, the version which actually has the problem.
I had - a couple months ago - someone do sql-injections, like one request per second … And I was observing him live (and fixed it like 1 min after detecting that) - the main problem was just that I hadn't followed conventions when writing that code. Thus, I added a small static analysis to our deploy pipeline to catch that (and uncovered a couple more vulnerable places, with exactly that same problem).
so er, @Danack or @Trowski, or to whom it may concern, if I were hypothetically to try and update auryn's phpunit version to something higher than 4, do you think I should go strongly all the way up to 9, or simply 5.7 (which allows my test to fail in the desired place) and maybe have more chance for it to actually happen?
@bwoebi yeah, developer education doesn't scale though. It should be possible to write libraries that are safe to use, without a more senior developer watching for naive errors. Or having to remeber/bother setting up very specific CI tools to detect.
@FélixGagnon-Grenier maybe just open an issue. If we're going to officially move git repo, we may as well discuss dropping PHP 5.4 support.....
sure, good idea, I hadn't realized it was about the PHP version
@FélixGagnon-Grenier There's a PR out there for upgrading PHPUnit, and I think @kelunik was working on that too.
Let's maybe get together on that so we're not duplicating work.
I would merge that, but unfortunately I don't have rights.
pokes @kelunik
That's mostly why we're moving it to amphp, so we can control over the repo.
I could fork from the PR's branch, presuming it'll get merged at some point
@FélixGagnon-Grenier Let's wait for @kelunik to reply, as I'm not sure what he was working on.
23:45
sure :)
00:00 - 23:0023:00 - 00:00

« first day (3791 days earlier)      last day (1382 days later) »