Check the code with spaze/phpstan-disallowed-calls and all its bundled rules - #42
Merged
Conversation
…led rules All five bundled config files are included. The dangerous, execution, insecure, and loose ones pass with no changes and no per-path exceptions; even the `print_r()` rule is happy, because the leak tests use the return-a-string form which the bundled rule allows. The non-timing-safe one, new in version 4.14, flags `hex2bin()`, `bin2hex()`, `base64_encode()`, and `base64_decode()`, whose run time depends on the processed bytes, which can leak them. The library code already used only the constant-time sodium functions; the tests and the README key generation examples now do too, so `bin2hex(random_bytes(32))` became `sodium_bin2hex(random_bytes(32))`. Not that anyone could measure the run time of a test or of a one-off key generation, but the examples teach what the rules then enforce, and a blanket rule beats deciding per call site whether the bytes are secret. `AGENTS.md` no longer scopes the sodium-functions rule to `src/` and no longer excuses the tests, PHPStan now enforces the rule everywhere.
There was a problem hiding this comment.
Pull request overview
This PR tightens static analysis by enabling spaze/phpstan-disallowed-calls (including the new non-timing-safe rules) and updates the codebase’s tests and documentation examples to use constant-time sodium_* encoding helpers instead of bin2hex().
Changes:
- Add
spaze/phpstan-disallowed-callstorequire-devand include all bundled rule sets inphpstan.neon. - Replace
bin2hex(...)withsodium_bin2hex(...)in tests and README key-generation examples. - Update
AGENTS.mdto reflect that the constant-time encoding rule is now enforced repo-wide (including tests).
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/SymmetricKeyEncryptionTest.phpt | Switch test key material generation from bin2hex() to sodium_bin2hex() to satisfy non-timing-safe call rules. |
| tests/AuthenticatedPublicKeyEncryptionTest.phpt | Replace bin2hex() usage with sodium_bin2hex() for secret/public key hex encoding in tests. |
| tests/AnonymousPublicKeyEncryptionTest.phpt | Replace bin2hex() usage with sodium_bin2hex() for key encoding in tests. |
| README.md | Update key-generation examples to use sodium_bin2hex() (documentation still needs a small format regex adjustment). |
| phpstan.neon | Include spaze/phpstan-disallowed-calls extension and all bundled rule configs. |
| composer.json | Add spaze/phpstan-disallowed-calls to require-dev. |
| AGENTS.md | Document repo-wide enforcement of constant-time sodium encoding functions via PHPStan rules. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All five bundled config files are included. The dangerous, execution, insecure, and loose ones pass with no changes and no per-path exceptions; even the
print_r()rule is happy, because the leak tests use the return-a-string form which the bundled rule allows.The non-timing-safe one, new in version 4.14, flags
hex2bin(),bin2hex(),base64_encode(), andbase64_decode(), whose run time depends on the processed bytes, which can leak them. The library code already used only the constant-time sodium functions; the tests and the README key generation examples now do too, sobin2hex(random_bytes(32))becamesodium_bin2hex(random_bytes(32)). Not that anyone could measure the run time of a test or of a one-off key generation, but the examples teach what the rules then enforce, and a blanket rule beats deciding per call site whether the bytes are secret.AGENTS.mdno longer scopes the sodium-functions rule tosrc/and no longer excuses the tests, PHPStan now enforces the rule everywhere.