Page MenuHomePhabricator

phan-taint-check test failure for exit/die with php8.4
Closed, ResolvedPublic

Description

exit and die changed from language construct to functions - https://php.watch/versions/8.4/exit-die-as-functions

This also affects phan-taint-check how to detect exit and die calls

1) SecurityCheckTest::testIntegration with data set "exit" ('exit', 'integration/exit/test.php:4 S...aped\n')
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
-'integration/exit/test.php:4 SecurityCheck-XSS Echoing expression that was not html escaped\n
-integration/exit/test.php:14 SecurityCheck-XSS Echoing expression that was not html escaped\n
-'
+''

/src/tests/SecurityCheckTest.php:181

Event Timeline

Change #1119862 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[mediawiki/tools/phan/SecurityCheckPlugin@master] Add taintedness data for exit() and die() as functions

https://gerrit.wikimedia.org/r/1119862

Change #1124215 had a related patch set uploaded (by Jforrester; author: Jforrester):

[integration/config@master] Zuul: [mediawiki/tools/phan/SecurityCheckPlugin] Disable on PHP 8.4

https://gerrit.wikimedia.org/r/1124215

Change #1124215 merged by jenkins-bot:

[integration/config@master] Zuul: [mediawiki/tools/phan/SecurityCheckPlugin] Disable on PHP 8.4

https://gerrit.wikimedia.org/r/1124215

Mentioned in SAL (#wikimedia-releng) [2025-03-04T01:42:58Z] <James_F> Zuul: [mediawiki/tools/phan/SecurityCheckPlugin] Disable on PHP 8.4, for T386570

Change #1119862 merged by jenkins-bot:

[mediawiki/tools/phan/SecurityCheckPlugin@master] Add taintedness data for exit() and die() as functions

https://gerrit.wikimedia.org/r/1119862

Mentioned in SAL (#wikimedia-releng) [2025-03-07T20:53:50Z] <James_F> Zuul: [wikipeg] Enable PHP 8.4 as voting, for T386570

Mentioned in SAL (#wikimedia-releng) [2025-03-07T21:00:23Z] <James_F> Zuul: [mediawiki/libs/Shellbox] Enable PHP 8.4 as voting, for T386570

I'm not sure this is "Resolved"; we had to temporarily drop CI running PHP 8.4 for the mediawiki/tools/phan/SecurityCheckPlugin repo just to get the patch to pass. :-(

Yeah, tests are still failing because phan isn't ready for PHP 8.4 (I'm not sure to what degree, i.e. if it's just the expected test output, or if it has more serious bugs). Tagging as upstream, since this is now tracked in https://github.com/phan/phan/issues/4894. To kick things off, I made a small patch to require a newer version of php-ast with PHP 8.4. Then there's going to be more to do, but I'd rather wait until this first PR is merged (and see how long it takes).

The failure on taint for exit/die is gone, only the upstream tests are failing (running after taint tests). Maybe the upstream problems with php8.4 needs tracking in phabricator, but taint as-is should be fine for php8.4 (from my understand of the current situation, but it also okay to keep this task open).

I thought we could track that here. After all, phan tests are part of the seccheck test suite, so the task title still applies. As for supporting running on PHP 8.4 (the real deal), I too believe we won't need to make any other changes once it's supported upstream.

There has been some activity upstream, and the test suite now passes on PHP 8.4. So we're just waiting for a release.

Change #1154823 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[mediawiki/tools/phan/SecurityCheckPlugin@master] Bump phan/phan to 5.4.6

https://gerrit.wikimedia.org/r/1154823

Change #1154824 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[integration/config@master] Zuul: [mediawiki/tools/phan/SecurityCheckPlugin] Test on PHP 8.4

https://gerrit.wikimedia.org/r/1154824

Change #1154824 merged by jenkins-bot:

[integration/config@master] Zuul: [mediawiki/tools/phan/SecurityCheckPlugin] Test on PHP 8.4

https://gerrit.wikimedia.org/r/1154824

Mentioned in SAL (#wikimedia-releng) [2025-06-09T14:16:28Z] <James_F> Zuul: [mediawiki/tools/phan/SecurityCheckPlugin] Test on PHP 8.4, for T386570

Change #1154823 merged by jenkins-bot:

[mediawiki/tools/phan/SecurityCheckPlugin@master] Bump phan/phan to 5.4.6

https://gerrit.wikimedia.org/r/1154823