PHP 8.1.0 Beta 3 available for testing – PHP: Hypertext Preprocessor

The PHP team is pleased to announce the release of PHP 8.1.0, Beta 3. This is the third beta release, continuing the PHP 8.1 release cycle, the rough outline of which is specified in the PHP Wiki. For source downloads of PHP 8.1.0, Beta 3 please visit the download page. Please carefully test this version and report any issues found in the bug reporting system. Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the NEWS file or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive. The next release will be the first release candidate (RC 1), planned for 2 September 2021. The signatures for the release can be found in the manifest or on the QA site. Thank you for helping us make PHP better.

Changelog generator for GitHub milestones – Rob Allen

For many years now, I’ve been using Matthew Weier O’Phinney’s changelog_generator script to generate an easy-to-read list of changes for a given milestone. Time has moved on; the Laminas project now uses Laminas Automatic Releases and Matthew hasn’t updated his script since 2013. Since PHP 8, warnings have started appear, so it’s clear updates were required. While I fully intend to see if I can use Automatic Releases on some projects, I have others where this is unlikely to happen and will continue to use changelog-generator.

Looking into it, I worked out that the warnings were from dependent packages. PHP has changed a bit since 2013. My first idea was to simply update to the latest Laminas versions of the dependencies, but I discovered that the Console and Http components are no longer actively maintained, so new components would be needed. I don’t particuarly want to have to do this all again in a few years time when the replacements that I pick don’t support PHP 8.4 or whatever, so I decided to remove the dependencies completely.

Looking at Console, I quickly realised that only one class was used by changelog-generator: Getopt, which worked fine under PHP 8. So, I copied that one class to src, changed the namespace and called it done. For Http, I wrote a new HttpClient class that only makes GET requests using PHP’s curl functions. I’m reasonably confident that the API to those functions won’t be changing signicantly.

While I was messing around, I also fixed a few bugs so that searching by title will look for closed milestones and it now lists the last 20 milestones if you don’t provide an argument. Just a couple of quality of life features to make make it easier for me to use.

My version is now up on Packagist if you need something like this. However, I strongly recommend looking at Laminas Automatic Releases as that automates all the work required for doing a release. If you just need a formatted list of closed issues though, grab this and see if it works for you.

Thoughts on dependencies

My general view is that if it’s not core to your application, then using a dependent package is the way forward. There’s rarely any benefit from spending time working on something that others have already built and to which you are not adding value. This is particularly true for applications where you are adding new features and have better things to do.

However, sometimes this isn’t the right choice. In this case, I need a very small subset of what a dependent package provides. I took the view that maintaining the dependencies would be more long-term work than writing the small components that I actually needed. Particularly, as this tool is stable.

Sometimes this is the right choice for a component in my big projects too.

Xdebug Update: July 2021 – Derick Rethans

Xdebug Update: July 2021

In this monthly update I explain what happened with Xdebug development in this past month. These will be published on the first Tuesday after the 5th of each month.

Patreon and GitHub supporters will get it earlier, around the first of each month.

You can become a patron or support me through GitHub Sponsors. I am currently 57% towards my $2,000 per month goal. If you are leading a team or company, then it is also possible to support Xdebug through a subscription.

In July, I worked on Xdebug for about 50 hours, with funding being around 25 hours, which is only half.

PHP 8.1 Support

Now PHP 8.1’s feature freeze has happened, I am working on integrating the missing features into Xdebug. Last month I added support for PHP 8.1’s Enum type, but this required a little bit more work as it was emitting the same XML attribute more than once in some occasions. This came to the surface after adding support for Readonly Properties, another new feature in PHP 8.1.

IDEs have so far not yet been updated to make use of these new “facets” that Xdebug’s debugger emits. PhpStorm’s tracker has an issue for readonly as well as enums. The VS Code plugin’s tracker has issues for readonly and enums as well.

I also had to make some more tweaks with regard to PHP 8.1’s changes to internals, most notably related to static properties.

Truncated by Planet PHP, read more at the original (another 1866 bytes)

PHP 8.1.0 Beta 2 available for testing – PHP: Hypertext Preprocessor

The PHP team is pleased to announce the first beta release of PHP 8.1.0, Beta 2. This continues the PHP 8.1 release cycle, the rough outline of which is specified in the PHP Wiki. For source downloads of PHP 8.1.0, Beta 2 please visit the download page.Please carefully test this version and report any issues found in the bug reporting system.Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive. The next release will be Beta 3, planned for Aug 19 2021.The signatures for the release can be found in the manifest or on the QA site.Thank you for helping us make PHP better.

PHP Internals News: Episode 92: First Class Callable Syntax – Derick Rethans

PHP Internals News: Episode 92: First Class Callable Syntax

In this episode of “PHP Internals News” I chat with Nikita Popov (Twitter, GitHub, Website) about the “First Class Callable Syntax” RFC.

The RSS feed for this podcast is https://derickrethans.nl/feed-phpinternalsnews.xml, you can download this episode’s MP3 file, and it’s available on Spotify and iTunes. There is a dedicated website: https://phpinternals.news

Transcript

Derick Rethans 0:14

Hi, I’m Derick. Welcome to PHP internals news, the podcast dedicated to explaining the latest developments in the PHP language. This is Episode 92. Today I’m talking with Nikita Popov about a first class callable syntax RFC that he’s proposing together with Joe Watkins. Nikita, would you please introduce yourself?

Nikita Popov 0:36

Hi, Derick. I’m Nikita and I am still working at JetBrains. And still working on PHP core development.

Derick Rethans 0:43

Just like about half an hour ago when we recorded an earlier episode.

Nikita Popov 0:47

Exactly.

Derick Rethans 0:48

This RFC has no relation to read only properties. What is the first class callable syntax RFC about?

Nikita Popov 0:55

The context here is that PHP has the callable syntax based on literals, which is that if you just use a plain string, it’s interpreted as a function name, and an array where the first element is an object, and the second one is a method name, that’s methods. Or the first element is the class name, and the second one is method name, that’s a static method.

Derick Rethans 1:17

I would consider this concept a bit of a hack, especially the the one with the arrays, and I reckon you feel similar and hence this RFC?

Nikita Popov 1:27

Yes, I do. So the current callable syntax has a couple of issues. I think the core issue is that it’s not really analysable. So if you see this kind of like array with two strings inside it, it could just be an array with two strings, you don’t know if that’s supposed to actually be a static method reference. If you look at the context of where it is used, you might be able to figure out that actually, this is a callable. And like in your IDE, if you rename this method, then this array should also be this array element will also be renamed. But there’s like a lot of complex reasoning that the static analyser has to perform. That’s one side of the issue. The second one is that callables are not scope independent. For example, if you have a private method, then like at the point where you create your callable, like as an array, it might be callable there, but then you pass it to some other function. And that’s in a different scope. And suddenly that method is not callable there. So this is a general issue with both like this callable syntax based on arrays, and also the callable type. It’s a callable at exactly this point, not callable at a later point. This is what the new syntax essentially addresses. So it provides a syntax that like clearly indicates that yes, this really is a callable, and it performs the callable callability check at the point where it’s created, and also binds the scope at that time. So if you pass it to a different function in a different scope, it still remains callable.

Derick Rethans 3:01

And it’s guaranteed to always be callable.

Nikita Popov 3:03

Yeah, exactly.

Derick Rethans 3:04

What does the syntax like?

Truncated by Planet PHP, read more at the original (another 13299 bytes)

PHP 8.1.0 Beta 1 available for testing – PHP: Hypertext Preprocessor

The PHP team is pleased to announce the first beta release of PHP 8.1.0, Beta 1. This continues the PHP 8.1 release cycle, the rough outline of which is specified in the PHP Wiki. For source downloads of PHP 8.1.0 Beta 1 please visit the download page.Please carefully test this version and report any issues found in the bug reporting system.Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive. The next release will be Beta 2, planned for Aug 5 2021.The signatures for the release can be found in the manifest or on the QA site.Thank you for helping us make PHP better.

A series of unfortunate commits: notable software security stories – platform.sh

In March, news broke that two malicious commits were introduced onto the in-development PHP 8.1 branch by perpetrators pretending to be Rasmus Lerdorf and Nikita Popov. The response by the PHP community to this attack was a shining example of the openness and transparency of the open-source world.
We’re going to take a closer look at the PHP 8.1 story to uncover what lessons there are to be learned on the value of visibility in coding.

Setting HTTP status code based on Exception in Slim 4 – Rob Allen

One thing that’s quite convenient is to be able to throw an exception with a valid HTTP code set and have that code sent to the client.

For example, you may have:

throw new \RuntimeException("Not Found", 404);

With the standard Slim 4 error handler, this response is sent to the client:

$ curl -i -H "Accept:application/json" http://localhost:8888
HTTP/1.1 500 Internal Server Error
Host: localhost:8888
Content-type: application/json { "message": "Slim Application Error"
}

Ideally we want the status code to be 404.

Option 1: Use an HttpException

The simplest solution is to use one of Slim’s HttpException classes:

use Slim\Exception\HttpNotFoundException; ... throw new HttpNotFoundException($request);

This is only useful in a Request Handler as you need a Request object, but the expected response is sent to the client:

$ curl -i -H "Accept:application/json" http://localhost:8888
HTTP/1.1 404 Not Found
Host: localhost:8888
Content-type: application/json { "message": "404 Not Found"
}

Simple and easy!

Option 2: Override the ErrorMiddleware

There are situation when you can’t simply replace the exception thrown. For example, you’re updating an application from Slim 3 and you have hundreds of customised exceptions already throwing, or you throw from a class that doesn’t have a Request object instance available.

In these cases, the easiest solution is to extend the Slim ErrorMiddleware to wrap the exception in an

HttpException

and then the standard error handling and rendering will “just work”.

I’m feeling a little lazy, so let’s use an anonymous class to do replace the call to $app->addErrorMiddleware():

$container = $app->getContainer(); $logger = $container->has(LoggerInterface::class) ?$container->get(LoggerInterface::class) : null; $errorMiddleware = new class ( callableResolver: $app->getCallableResolver(), responseFactory: $app->getResponseFactory(), displayErrorDetails: false, logErrors: true, logErrorDetails: true, logger: $logger ) extends \Slim\Middleware\ErrorMiddleware { public function handleException( ServerRequestInterface $request, Throwable $exception ): \Psr\Http\Message\ResponseInterface { // determine that this exception should be wrapped. I'm checking for code between 400 & 599 if ($exception->getCode() >= 400 && $exception->getCode() < 600) { // wrap the exception in an HttpException $exception = new \Slim\Exception\HttpException( $request, $exception->getMessage(), $exception->getCode(), $exception ); $exception->setTitle($exception->getMessage()); } return parent::handleException($request, $exception); } }; $app->addMiddleware($errorMiddleware);

Behind the scenes of $app->addErrorMiddleware(), the \Slim\Middleware\ErrorMiddleware is constructed and then added to the middleware stack. We replicate that we an anonymous class that overrides handleException() to wrap the thrown exception if required.

Looking at the code in detail

There’s quite a lot going on here, so let’s break it down into parts.

$container = $app->getContainer(); $logger = $container->has(LoggerInterface::class) ?$container->get(LoggerInterface::class) : null; $errorMiddleware = new class ( callableResolver: $app->getCallableResolver(), responseFactory: $app->getResponseFactory(), displayErrorDetails: false, logErrors: true, logErrorDetails: true, logger: $logger ) extends \Slim\Middleware\ErrorMiddleware {

The constructor to \Slim\Middleware\ErrorMiddleware takes 6 parameters, so when we instantiate, we have to pass them all in though it’s not unusual for the $logger parameter to be left off in the call to $app->addErrorMiddleware(). The easiest way to get a logger instance if there is one, is to grab it from the container where it should be registered under the \Psr\Log\LoggerInterface key which is imported into the file with a use statement.

I’ve used PHP 8’s named arguments as this constructor takes three booleans and it’s easier to remember what they do if they are label

Truncated by Planet PHP, read more at the original (another 2865 bytes)

PHP Internals News: Episode 91: is_literal – Derick Rethans

PHP Internals News: Episode 91: is_literal

In this episode of “PHP Internals News” I chat with Craig Francis (Twitter, GitHub, Website), and Joe Watkins (Twitter, GitHub, Website) about the “is_literal” RFC.

The RSS feed for this podcast is https://derickrethans.nl/feed-phpinternalsnews.xml, you can download this episode’s MP3 file, and it’s available on Spotify and iTunes. There is a dedicated website: https://phpinternals.news

Transcript

Derick Rethans 0:14

Hi, I’m Derick. Welcome to PHP internals news, a podcast dedicated to explaining the latest developments in the PHP language. This is Episode 91. Today I’m talking with Craig Francis and Joe Watkins, talking about the is_literal RFC that they have been proposing. Craig, would you please introduce yourself?

Craig Francis 0:34

Hi, I’m Craig Francis. I’ve been a PHP developer for about 20 years, doing code auditing, pentesting, training. And I’m also the co-lead for the Bristol chapter of OWASP, which is the open web application security project.

Derick Rethans 0:48

Very well. And Joe, will you introduce yourself as well, please?

Joe Watkins 0:51

Hi, everyone. I’m Joe, the same Joe from last time.

Derick Rethans 0:56

Well, it’s good to have you back, Joe, and welcome to the podcast Craig. Let’s dive straight in. What is the problem that this proposal’s trying to resolve?

Craig Francis 1:05

So we try to address the problem where injection vulnerabilities are being introduced by developers. When they use libraries incorrectly, we will have people using the libraries, but they still introduce injection vulnerabilities because they use it incorrectly.

Derick Rethans 1:17

What is this RFC proposing?

Craig Francis 1:19

We’re providing a function for libraries to easily check that certain strings have been written by the developer. It’s an idea developed by Christoph Kern in 2016. There is a link in the video, and the Google using this to prevent injection vulnerabilities in their Java and Go libraries. It works because libraries know how to handle these data safely, typically using parameterised queries, or escaping where appropriate, but they still require certain values to be written by the developer. So for example, when using a query a database, the developer might need to write a complex WHERE clause or maybe they’re using functions like datediff, round, if null, although obviously, this function could be used by developers themselves if they want to, but the primary purpose is for the library to check these values.

Derick Rethans 2:05

That is a method of doing it. What is this RFC adding to PHP itself?

Craig Francis 2:09

It just simply provides a function which just returns true or false if the variable is a literal, and that’s basically a string that was written by the developer. It’s a bit like if you did is_int or is_string, it’s just a different way of just sort of saying, has this variable been written by the developer?

Derick Rethans 2:28

Is that basically it?

Craig Francis 2:30

That’s it? Yeah.

Joe Watkins 2:32

It would also return true for variables that are the res

Truncated by Planet PHP, read more at the original (another 20645 bytes)