Support @param-taint in PHP (permit dashes in command aliases?)

[Krinkle]

Describe the bug

Unable to remove lines like @param-taint $foo none from the HTML output.

Currently this results in:

LinkRenderer.php:266: warning: argument '$target' from the argument list of
  LinkRenderer\makeBrokenLink has multiple @param documentation sections

Expected behavior

/**
 * Class that generates HTML anchor link elements for pages.
 *
 * @since 1.28
 */
class LinkRenderer {
	/**
	 * @param LinkTarget|PageReference $target
	 * @param-taint $target none
	 * @param string|HtmlArmor|null $text
	 * @param array $extraAttribs
	 * @param array $query
	 * @return string
	 */
	public function makeBrokenLink(
		$target, $text = null, array $extraAttribs = [], array $query = []
	) {
	}
}

ALIASES                = "codeCoverageIgnore=\noop" \
                         "codingStandardsIgnoreEnd=\noop" \
                         "codingStandardsIgnoreStart=\noop" \
                         "phan=\noop" \
                         "param-taint=\noop" \
                         "suppress=\noop"

Version
doxygen 1.9.2 and doxygen 1.9.3.

Additional context

error: Illegal ALIASES format 'param-taint=\noop'. Use "name=value" or "name{n}=value", where n is the number of arguments

I suspect there is (or once was) syntax ambiguity where a command that takes no argument needs to be distinct from other content. E.g. the full-stop in Hello @foo., which seems reasonable to allow as separator. I guess that means we currently also permit the dash to be used in this way, e.g. Hello @foo- How are you?. I'm hoping that maybe this is okay to change by considering the dash in this case (if there isn't a space after it) to be considered part of the command.

Or alternatively, we could perhaps do something clever where we first give it a chance to match a command including the adjecent dash, and if not known as command, fallback to rendering separately.

[albert-github]

The - is indeed the character that is not possible in an ID (in this case a command name), the question that arises is why do you need a - in the ID, can't you use an _.?

I think that the background is that the - sign is the minus sign and in computer languages (as far as I know) this character is not allowed in identifiers as it is the subtraction sign. The command name also is defined as an identifier and the hence exclusion.

[Krinkle]

@albert-github If I understand correctly, you're asking why the static analysis software declared its annotation as @param-taint rather than @param_taint. I'm guessing that the auhors felt a dash was more natural and consistent with other parts of the coding conventions in PHP.

For what it's worth, the defacto PHPDoc standard (draft) includes a - hyphen as a valid symbol part of a tag's name, with @phpdoc-event as example of a valid tag.

[albert-github]

I was indeed asking why you didn't use @param_taint, the mentioned phpdoc draft indeed includes the - as a normal character for a tag (for doxygen command name). Doxygen can't / won't copy everything possible things from every other documentation system also because doxygen is general purpose (tries to supports multiple computer languages) and e.g. phpdoc only supports php (as far as I know).

I think the enhancement request for the - is a valid request to be allowed in ALIASES.
@doxygen what do you think?

[albert-github]

I've just pushed a proposed patch, pull request #9451

[albert-github]

Code has been integrated in master on GitHub (please don't close the issue as this will be done at the moment of an official release).

[doxygen]

This issue was previously marked 'fixed but not released',
which means it should be fixed in doxygen version 1.9.5.
Please verify if this is indeed the case. Reopen the
issue if you think it is not fixed and please include any additional information
that you think can be relevant (preferably in the form of a self-contained example).