DEV Community: Denzyl Dick

How I made it impossible to write spaghetti code. Part 2

Denzyl Dick — Sun, 06 Sep 2026 14:01:02 +0000

This is the part(3) of a series. I suggest you read parts 1 and 2 before this one.

In part 2, I made sure that the test passed correctly. The focus now is how we traverse a block of code inside its scope. We should be able to increase the variables in the formula at the right moment.

If you have read part 1, you know that we need to implement the validate function that is mandatory in the trait Rule.

impl Rule for E009 {
    fn validate(
        &self,
        statement: &php_parser_rs::parser::ast::Statement,
    ) -> Vec<crate::project::Suggestion> {

    }}

Enter fullscreen mode Exit fullscreen mode

In part 2 we have learned that :

Nodes are like the conditional statement: if, else, while, for, etc.

Edges are the paths that can be taken.

The validate function will be executed for every statement in a source code. In the source code below, there are 32 lines of code.

<?php

class Index{

  public function tooComplex(){
    $a = 1;
    $b = 2;

    if($a > $b){
      if($b < $a){

        if($a == $b){

          while($b > $a){

          }

        }
      }
    }}}

Enter fullscreen mode Exit fullscreen mode

Phanalist needs a way to detect when we are in the function's scope with the name tooComplex(). With pattern matching, it is super easy to detect if the statement is either: if,else,etc.. The first statement that I want to match for is class Index{ and from there, we will continue down the tree. If you think the same way as I do you know that I will be using recursion to calculate the cyclomatic complexity. After we have matched the scope of the tooComplex() function.

impl Rule for E009 {
    fn validate(
        &self,
        statement: &php_parser_rs::parser::ast::Statement,
    ) -> Vec<crate::project::Suggestion> {
        let mut suggestions = Vec::new();
        let mut graph = Graph { n: 0, e: 0, p: 0 };
        match statement {
            Statement::Class(class) => {
                for member in &class.body.members {
                    match member {
                        ClassMember::ConcreteMethod(concretemethod) => {
                            match concretemethod.body.clone() {
                                MethodBody {
                                    comments: _,
                                    left_brace: _,
                                    statements,
                                    right_brace: _,
                                } => {
                                   /// HERE !!
                                    }
                                }
                            }
                        }
                        _ => {}
                    }
                }
            }
            _ => {}
        }
        suggestions
    }}

Enter fullscreen mode Exit fullscreen mode

If you aren't familiar with pattern matching, it's kind of a switch keyword on steroids. Look for the Look for /// HERE !! in the above code.

 MethodBody {
                                    comments: _,
                                    left_brace: _,
                                    statements,
                                    right_brace: _,
                                } => {
                                    /// HERE 1

                                    }
                                }

Enter fullscreen mode Exit fullscreen mode

As you can see we have four parameters that we can use. The ones we are looking for are the statements. The type of this parameter is Vec<Statement> meaning it can be anything.

Let's use the Graph we previously created in part 2

In the source code below, Phanalist calls a function with let graph = calculate _cyclomatic_complexity(); This function will return a struct of the type Graph. The first parameter passed is statements.clone(). This function uses recursion to traverse down the tree. In part 4 I will explain the recursion we were thinking about.


 let graph = calculate_cyclomatic_complexity(
                                        statements.clone(),
                                        &mut graph,
                                    );
 if graph.calculate() > 10 {suggestions.push(Suggestion::from("This method body is too complex. Make it easier to understand.".to_string(),
                concretemethod.function,"E009".to_string() ));}

Enter fullscreen mode Exit fullscreen mode

The Graph struct has the calculate function we previously used to calculate the cyclomatic complexity. My threshold is always ten, so I will be using that.

If the value exceeds ten, I push the Suggestion onto the vector. The vector of Suggestion is the value returned to the validate function's caller.

Recursion

In computer science, recursion is a method of solving a computational problem where the solution depends on solutions to smaller instances of the same problem. Recursion solves such recursive problems using functions that call themselves from within their code. Wikipedia

Conclusion

If you are a PHP developer, you know that a developer can make many more mistakes in PHP. In the future, the list of Rules will continue to grow into something more useful.

Thanks for reading!

Contribution is always welcome if you have a mistake you would like to add to Phanalist.

Originally published on ZyVOP

💡 For more articles like this, subscribe to the ZyVOP newsletter!

Why is unserializing an object in PHP a bad idea?

Denzyl Dick — Sun, 06 Sep 2026 14:00:03 +0000

Serializing in PHP is a way of converting a PHP object into a string. This string can be used in various ways, such as storing it in a database or passing it to another function. The PHP documentation says this is handy when passing PHP values around without losing their type and structure. But I have never had that problem before. Maybe I’m not seeing it.

<?php$test = new User();$test->name = "Denzyl";echo serialize($test);/// Output: O:4:"User":1:{s:4:"name";s:6:"Denzyl";}

Enter fullscreen mode Exit fullscreen mode

So, let's digest the string. The o stands for Object, and the following number is the length of the object's name. The two letters s stand for string and the length of the string's name.

When you need to convert the string back into PHP, call the unserialize function and pass the string as a parameter.

When serializing an object, two methods are automagically being called. __serialize() & __sleep(). This will allow the class author to do something before converting the object into a string.

That is straight to the point. But for now, let’s focus on unserializing the string. This means converting the string into a real PHP object that can be later used at runtime in your PHP code.

<?php

$string = 'O:8:"User":1:{s:4:"name";s:6:"Denzyl";}';echo unserialize($string)->name;/// Output: Denzyl

Enter fullscreen mode Exit fullscreen mode

The same functionalities also apply to unserializing. But this time, the two methods are __unserialize() and __wakeup().

But why is it a bad idea?

Using unserialize without knowing it can lead to remote code execution. That's why they say never to trust input.

Let's say you are lazy and you trust a random input, and you concatenate to the serialized object so you can

change a value inside the object. BOOM, you can be hacked.

<?php$username = $_GET['username'];$serialized = 'O:8:"User":1:{s:4:"name";s:6:"' . $username . '";}';

Enter fullscreen mode Exit fullscreen mode

I won't explain how to write an exploit for something like this. Some tools can automatically generate a payload for you, and you can call yourself a script kiddie(we all start somewhere). The one I know is PHPGGC.

To understand the exploit, you can read the OWASP article.

If you didn't know this before, also read the rest of the OWASP articles about vulnerabilities

I know I haven't explained how to write an exploit. I don't think I can do a better job than the articles on the internet. But now you know this, and you can do your research.

How to prevent being exploited?

Why would you want to use this? I do not know; I haven't been programming long enough(~15 years) to have the opportunity to solve a problem using serialize/unserialize.

My solution is too drastic. The simple answer is. Don't use it in my PHP projects.

This article is part of a series of articles in my journey of writing a static analysis tool for PHP that can scan massive projects in a couple of minutes/seconds. And look for rules

that the developers want to have in their projects. At the time of writing this article, I'm working on a rule to stop

people from using unserialize, and it should be ready for the next release. Follow the project so that you will get notified when

I decided to write even more rules.

Originally published on ZyVOP

💡 For more articles like this, subscribe to the ZyVOP newsletter!

From Throw-and-Pray to Predictable: Introducing Box, a Rust‑Inspired Result Type for PHP 8.1+

Denzyl Dick — Sun, 06 Sep 2026 13:59:15 +0000

Most PHP developers are stuck in a cycle of "throw-and-pray" error handling.

You write a method, it implicitly throws an exception somewhere deep in the stack, and you pray a try/catch block catches it before it crashes the application. The method signature tells you nothing. It’s a silent guessing game.

The alternative? Returning null or false, which leads to silent failures and a total loss of error context.

To solve this in my own production environments, I built Box—a modern, type-safe functional error handling library for PHP 8.1+ heavily inspired by Rust's Result type.

The core philosophy is simple: If an error can happen, the codebase should force the caller to acknowledge it.

By decoupling the fallible domain logic via an Item interface and passing it through Box::put(), it translates imperative throwing code into an immutable, type-safe pipeline (Result).

Why this approach changes the game for complex PHP backends:

Honest API Contracts: Using PhpDoc generics, your IDE and static analyzers (PHPStan/Psalm) force you to handle both the Ok and Error tracks. No more forgotten catches.

Railway-Oriented Programming: It introduces clean, declarative method chaining (map, flatMap, recover, tapOk) so your data pipelines remain pure and highly readable.

Batch Operations Built-In: It natively handles combining independent results, short-circuiting sequential dependencies, or partitioning bulk successes/failures without messy nested if statements.

I’ve made the repository completely public and open-source. If you are trying to scale modern PHP systems safely, take a look at the architecture and the README documentation:

👉 https://github.com/denzyldick/box

How is your team handling strict error boundaries and exception isolation in high-load PHP applications? Let's discuss below.

💡 TL;DR & Key Takeaways:

**TL;DR:** PHP’s common “throw‑and‑pray” pattern hides errors and forces developers to guess exception handling, while returning null/false discards context. The open‑source **Box** library (PHP 8.1+) introduces a Rust‑inspired Result\ type that enforces compile‑time error acknowledgment, enabling clean, type‑safe pipelines and built‑in batch handling.

- **Honest API contracts:** PhpDoc generics let IDEs and static analysers require explicit handling of both success (Ok\) and failure (Error\) paths.

- **Railway‑oriented programming:** Immutable method chaining (map\, flatMap\, recover\, tapOk\) keeps data pipelines pure and readable.

- **Built‑in batch operations:** Native support for combining, short‑circuiting, and partitioning multiple results eliminates tangled nested conditionals.

Originally published on ZyVOP

💡 For more articles like this, subscribe to the ZyVOP newsletter!

Building Siegu: A Local-First, P2P Google Photos Alternative in Rust & Tauri

Denzyl Dick — Sun, 06 Sep 2026 13:57:18 +0000

I can't remember exactly when I started using Google Photos, but it’s been my go-to for a long time, probably since it was released. It is one of the most useful pieces of software I've ever used. However, in 2021, I became a father, which completely changed how I used it and made me question if I could keep relying on it. I started taking far more pictures and videos than I ever had before. A couple of months later, the sheer volume of media forced me to start paying for extra Google Photos storage.

Around that time, I questioned why I was paying to store pictures I took myself. I started digging around for another solution to avoid those storage fees. I realized that across all my devices in the office (Android phones, tablets, a laptop, and a desktop), I already had plenty of storage. Each device had a minimum of 500GB, which was more than enough to hold all my media. I also had a DigitalOcean droplet used for random coding projects, but going that route meant paying for another server and dealing with a complex setup, so I skipped it.

Next, I looked into alternatives like rsync, Immich, Syncthing, and similar tools. Immich is great software with a solid UI, but the rest were still too complicated for my needs. I wanted the exact same "install and forget" experience that Google Photos provides. Setting those up took too much time, and I didn't love the UI/UX on most of them. If I had enough coffee and time, I could probably have made them work, but where is the fun in that? I decided to build my own solution so I could do whatever I wanted.

Here is what I wanted to accomplish without spending money or waiting too long:

Sync all files across all my devices.
Analyze all the files to extract useful information.
Provide a simple UI that even a five-year-old could use.
Ensure photo searches are fast.
Keep the user experience non-technical.

Google Photos sometimes takes too long to load old memories, but its best feature is how easy it is to find a picture based on a location or person. I wanted that exact same functionality.

So, I grabbed my coffee, put on my geeky hat, and started researching how to build this. This was before ChatGPT, so I had to do it the old-fashioned way by reading articles and extracting the bits and bytes.

After a couple of brainstorming sessions, I nailed down my tech stack. Naturally, I chose Rust because it seemed cool. I also came across Tauri right around the time their team started the project. For syncing, I discovered the WebRTC protocol. It seemed perfect for allowing devices to communicate without a centralized server.

I eventually realized that wasn't entirely true; you still need a centralized way (a signaling server) for devices to find each other. I tried using QR codes to solve this, but it was too complicated. Not every device has a camera, meaning users would eventually have to enter IP addresses manually, which violated my "non-technical" rule.

Around that time, I figured out how to extract metadata from pictures and used jwalk to recursively walk directories. My proof of concept was working.

Then I hit a roadblock: Tauri didn't support mobile yet. I waited for months. One random day, I saw an article about running a Tauri application on mobile. I grabbed my laptop, jumped in, and actually got an app running on my phone. Official mobile support wasn't fully there yet, so I had to wait again until the Tauri team officially released it, which they eventually did.

When that day came, I started working on the project on and off in my free time. Things moved slowly. WebRTC was complicated, and extracting information from the pictures was a headache. But then the software industry shifted, and AI tools arrived. After initially feeling like I was cheating myself by using AI, I got over it once I saw how fast I was solving problems and creating things.

(Note: I only used Gemini to fix this article, not to generate it 🚀)

I decided the QR-code signaling method was definitely too complex. Instead, I discovered mDNS, which allowed me to find other devices on my local network without overcomplicating things. It was difficult to implement, but I got it working.

That left one problem: what if I'm not at home? I realized I still needed a signaling server. I decided to vibe-code a separate project in Go, making it easy to host on my own server using a simple Docker Compose setup. I originally wrote it in Rust, but I wanted to give myself the opportunity to use Go after a couple of years. I currently use OpenCode with the Big Pickle model, and it gets the job done.

Next came the complicated part: picking the right models to analyze all my media. I ended up building a pipeline to run several distinct local models against every file. As of right now, Siegu handles Smart Search (finding objects and scenes), Face Grouping, and a Text Finder for things like receipts. The best part? It all runs locally. The Face Grouping model is only 2MB, and the Smart Search model is 350MB, meaning it stays entirely on-device.

My only current issue is my hardware. I use a ThinkPad E14, which defaults to the CPU instead of the GPU. I know about OpenVINO, but I don't fully understand it yet. I'm going to try to fix this before the 1.0 release. It takes around 40+ hours to analyze about 4,000 pictures and videos that I extracted from a Google Takeout export. And I didn't even extract everything yet, so when I'm done, I will probably need to buy new hardware.

If you're still reading, I know I'm just yapping now. But I got it to work, and the day I no longer have to pay to look at my own pictures is coming soon.

The project is called Siegu, which means "blind" in Papiamentu, the language of Curaçao (that tiny island in the World Cup). Some people will point out that it won't work behind certain firewalls or without a TURN server, but if that's your situation, then you just can't use it. That sounds like a "you" problem.

The project is open source and available on GitHub: https://github.com/denzyldick/siegu.

My next article will be for the 1.0 release. Right now, it's just me, Big Pickle, and sometimes Codex building this, so it takes time.

I also expect a lot of issues with this. I only have a Linux box and an Android device, but I want to support everything eventually. So when you fork it, please open GitHub issues for anything that isn't working—because it probably won't run without a few problems! If you are interested, you know what to do: just fork it! :D

Originally published on ZyVOP

💡 For more articles like this, subscribe to the ZyVOP newsletter!

Finding "Duplicates Through Time"

Denzyl Dick — Sun, 06 Sep 2026 13:56:11 +0000

Finding "Duplicates Through Time": How I Cleaned Up 300GB of Photos Without Losing Quality

Lately, I have been playing around with my personal photo and video library (around 300GB of files, spanning 10+ years of memories). I had a specific type of problem: I needed to save space on my SSD, but I did not want to pay any third-party cloud provider for extra storage.

To make things trickier, I was traveling in a remote location without any electronics stores nearby. Buying an external hard drive was out of the question. I had my laptop, tablet, and smartphone. Together, they had enough cumulative storage, but my laptop drive was suffocating.

What if I just made the library smaller?

The Compression Route (and a Nod to Middle-Out)

There are different ways to make files smaller, and the most obvious route is compression.

Whenever compression comes up in software engineering, I am always surprised by how many developers have not seen HBO's Silicon Valley. If you have not watched it yet, take a break and go check it out. Great show.

In the real world, though, lossy re-encoding means sacrificing quality. When dealing with a decade of personal memories, heavy compression feels like the wrong compromise. You do not want high-resolution vacation shots turning into pixelated JPEGs just to save a few gigabytes.

Stage 1: Deleting Big Files (The Easy Part)

My next thought was simple: prune the clutter and remove the massive files.

Finding large video files was easy enough. A quick shell command or custom script sorted everything by size, allowing me to offload old movies and raw video dumps.

That gave me some breathing room, but it hit a wall quickly. Depending on how your library is structured, video pruning only works up to a certain point. The core of my storage problem was thousands of individual photographs.

The "Aha!" Moment: Burst Mode & Over-Shooting

A couple of days later, a friend asked me to send her a picture we took when we visited the Empire State Building in New York.

When I opened my library, I realized something: she asked for one picture, but I had taken seven nearly identical shots.

I always do this on holiday so people can choose the best angle or expression. A quick burst of 5 to 10 photos, just to capture one good moment.

That was the lightbulb moment:

How can I programmatically find all the "short burst" photos across 10+ years of media?

Or phrased better: How do I detect duplicates through time?

Enter Siegu

This problem led me to start building siegu, a local tool designed to tackle time-clustered, visually similar photos across massive personal libraries.

Instead of looking for exact byte-for-byte duplicates (which standard deduplication tools do via MD5 or SHA256 hashes), siegu approaches the problem using two dimensions:

Temporal Proximity (Time Windows): Grouping photos shot within seconds or milliseconds of each other using EXIF metadata (DateTimeOriginal).
Visual Similarity (Perceptual Hashing): Comparing photos within those candidate windows using perceptual hashes (like pHash or dHash) to see if they depict the same scene, regardless of minor lighting changes or slight hand movements.

By combining timestamps with perceptual hashing, you do not waste CPU cycles comparing a picture from 2014 in New York with a picture from 2022 in Tokyo. You only analyze candidate groups that were actually taken in short bursts.

In Part 2, I will dive deep under the hood: breaking down the Rust implementation, showing how siegu extracts EXIF metadata concurrently, and walking through the exact perceptual hashing algorithm used to flag burst duplicates.

What is Siegu?

Originally published on ZyVOP

💡 For more articles like this, subscribe to the ZyVOP newsletter!

Finding "Duplicates Through Time"

Denzyl Dick — Sun, 06 Sep 2026 01:47:18 +0000

Finding "Duplicates Through Time": How I Cleaned Up 300GB of Photos Without Losing Quality

What if I just made the library smaller?

The Compression Route (and a Nod to Middle-Out)

There are different ways to make files smaller, and the most obvious route is compression.

Stage 1: Deleting Big Files (The Easy Part)

My next thought was simple: prune the clutter and remove the massive files.

Finding large video files was easy enough. A quick shell command or custom script sorted everything by size, allowing me to offload old movies and raw video dumps.

The "Aha!" Moment: Burst Mode & Over-Shooting

A couple of days later, a friend asked me to send her a picture we took when we visited the Empire State Building in New York.

When I opened my library, I realized something: she asked for one picture, but I had taken seven nearly identical shots.

I always do this on holiday so people can choose the best angle or expression. A quick burst of 5 to 10 photos, just to capture one good moment.

That was the lightbulb moment:

How can I programmatically find all the "short burst" photos across 10+ years of media?

Or phrased better: How do I detect duplicates through time?

Enter Siegu

This problem led me to start building siegu, a local tool designed to tackle time-clustered, visually similar photos across massive personal libraries.

Instead of looking for exact byte-for-byte duplicates (which standard deduplication tools do via MD5 or SHA256 hashes), siegu approaches the problem using two dimensions:

Temporal Proximity (Time Windows): Grouping photos shot within seconds or milliseconds of each other using EXIF metadata (DateTimeOriginal).
Visual Similarity (Perceptual Hashing): Comparing photos within those candidate windows using perceptual hashes (like pHash or dHash) to see if they depict the same scene, regardless of minor lighting changes or slight hand movements.

What is Siegu?

Building Siegu: A Local-First, P2P Google Photos Alternative in Rust & Tauri

Denzyl Dick — Thu, 30 Jul 2026 08:43:05 +0000

Here is what I wanted to accomplish without spending money or waiting too long:

Sync all files across all my devices.
Analyze all the files to extract useful information.
Provide a simple UI that even a five-year-old could use.
Ensure photo searches are fast.
Keep the user experience non-technical.

Google Photos sometimes takes too long to load old memories, but its best feature is how easy it is to find a picture based on a location or person. I wanted that exact same functionality.

Around that time, I figured out how to extract metadata from pictures and used jwalk to recursively walk directories. My proof of concept was working.

(Note: I only used Gemini to fix this article, not to generate it 🚀)

If you're still reading, I know I'm just yapping now. But I got it to work, and the day I no longer have to pay to look at my own pictures is coming soon.

The project is open source and available on GitHub: https://github.com/denzyldick/siegu.

My next article will be for the 1.0 release. Right now, it's just me, Big Pickle, and sometimes Codex building this, so it takes time.

How I handle my errors in PHP

Denzyl Dick — Mon, 25 May 2026 03:19:19 +0000

Most PHP developers are stuck in a cycle of "throw-and-pray" error handling.

The alternative? Returning null or false, which leads to silent failures and a total loss of error context.

To solve this in my own production environments, I built Box—a modern, type-safe functional error handling library for PHP 8.1+ heavily inspired by Rust's Result type.

The core philosophy is simple: If an error can happen, the codebase should force the caller to acknowledge it.

By decoupling the fallible domain logic via an Item interface and passing it through Box::put(), it translates imperative throwing code into an immutable, type-safe pipeline (Result).

Why this approach changes the game for complex PHP backends:
Honest API Contracts: Using PhpDoc generics, your IDE and static analyzers (PHPStan/Psalm) force you to handle both the Ok and Error tracks. No more forgotten catches.

Railway-Oriented Programming: It introduces clean, declarative method chaining (map, flatMap, recover, tapOk) so your data pipelines remain pure and highly readable.

Batch Operations Built-In: It natively handles combining independent results, short-circuiting sequential dependencies, or partitioning bulk successes/failures without messy nested if statements.
I’ve made the repository completely public and open-source. If you are trying to scale modern PHP systems safely, take a look at the architecture and the README documentation:
👉 https://github.com/denzyldick/box

How is your team handling strict error boundaries and exception isolation in high-load PHP applications? Let's discuss below.

Why is unserializing an object in PHP a bad idea?

Denzyl Dick — Thu, 18 Jul 2024 20:39:42 +0000

<?php
$test = new User();
$test->name = "Denzyl";
echo serialize($test);
/// Output: O:4:"User":1:{s:4:"name";s:6:"Denzyl";}

So, let's digest the string. The o stands for Object, and the following number is the length of the object's name. The two letters s stand for string and the length of the string's name.

When you need to convert the string back into PHP, call the unserialize function and pass the string as a parameter.

When serializing an object, two methods are automagically being called. __serialize() & __sleep(). This will allow the class author to do something before converting the object into a string.
That is straight to the point. But for now, let’s focus on unserializing the string. This means converting the string into a real PHP object that can be later used at runtime in your PHP code.

<?php

$string = 'O:8:"User":1:{s:4:"name";s:6:"Denzyl";}';
echo unserialize($string)->name;
/// Output: Denzyl

The same functionalities also apply to unserializing. But this time, the two methods are __unserialize() and __wakeup().

But why is it a bad idea?

Using unserialize without knowing it can lead to remote code execution. That's why they say never to trust input.
Let's say you are lazy and you trust a random input, and you concatenate to the serialized object so you can
change a value inside the object. BOOM, you can be hacked.

<?php
$username = $_GET['username'];
$serialized = 'O:8:"User":1:{s:4:"name";s:6:"' . $username . '";}';

To understand the exploit, you can read the OWASP article.
If you didn't know this before, also read the rest of the OWASP articles about vulnerabilities

I know I haven't explained how to write an exploit. I don't think I can do a better job than the articles on the internet. But now you know this, and you can do your research.

How to prevent being exploited?

Why would you want to use this? I do not know; I haven't been programming long enough(~15 years) to have the opportunity to solve a problem using serialize/unserialize.
My solution is too drastic. The simple answer is. Don't use it in my PHP projects.

This article is part of a series of articles in my journey of writing a static analysis tool for PHP that can scan massive projects in a couple of minutes/seconds. And look for rules
that the developers want to have in their projects. At the time of writing this article, I'm working on a rule to stop
people from using unserialize, and it should be ready for the next release. Follow the project so that you will get notified when
I decided to write even more rules.

Improve your CI output.

Denzyl Dick — Sat, 18 May 2024 20:10:54 +0000

Have you ever been in a situation where you made a PR or MR and waited for a couple of seconds for the output of the CI pipeline? But something went wrong, and you can't see the issue in the blink of an eye. And you get annoyed that you must read a few logs to discover the problem?

It's a scenario that many of us have likely encountered at some point.

This article teaches how to improve your CI output. I will use Github.

This article is part of a series about a static analysis tool I've worked on for over a year. It's called Phanalist. Please check it out and hit the star button. Thank you.

How can I improve the CI output in Github? When running your CI tools, you probably output everything to STDOUT and view the content in the log viewer.

Something like this:

The output format text in Phanalist is not so bad. It's readable because of the table layout. But why stop there?

Microsoft is not so evil anymore, and Github has solved that problem I've already. What we will be using is what they call SARIF. It stands
for Static Analysis Results Interchange Format. It's a specification for understanding the output of static analysis tools. That is how the tools can display information in the code scanning section under the security tab on a repository.

For Phanalist to have a chance to be adopted by more people, this is a must feature that should be implemented first. Then, I can focus on adding more rules to the tool.

For context, Phanalist consists of rules implemented by the contributors. Every rule has a detailed explanation of what you are doing wrong and guides you in the right direction so you can fix it.

The tools under the code scanning section use a Github action called github/codeql-action/upload-sarif. This action uploads a .sarif file to GitHub. Remember that you will need the right permissions to upload a file from the Github workflow. After uploading, Github will validate the file's content, and if there are any errors, they will be displayed in the logs. If everything goes well, you will have more issues to fix under the security tab.

The tools you use should have a Sarif output. At the time of writing, I do not know if the popular static analysis tools in the PHP ecosystem support Sarif, but if not, you can help them with that.

But Phanalist supports that format. It can output information in three formats: text, json, and sarif.

phanalist --src=. --output-format=sarif

The output will be something like this:

{
  "version": "2.1.0",
  "$schema": "http://json.schemastore.org/sarif-2.1.0-rtm.4",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Phanalist",
          "informationUri": "https://github.com/denzyldick/phanalist",
          "rules": [
            {
              "id": "e0009",
              "shortDescription": {
                "text": "Method is too complex"
              },
              "properties": {
                "category": "phanalist"
              }
            }
          ]
        }
      },
      "artifacts": [
        {
          "location": {
            "uri": "src/complex.php"
          }
        }
      ],
      "results": [
        {
          "level": "warning",
          "message": {
            "text": "Method is too complex."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/complex.php",
                  "index": 0
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 5
                }
              }
            }
          ],
          "ruleId": "no-unused-vars",
          "ruleIndex": 0
        }
      ]
    }
  ]
}

I won't explain Sarif in detail in this article; the people behind it have already done an excellent job.

The next step is to upload this output to Github using the github/codeql-action/upload-sarif.

on:
  push:
    branches:
      - "main"
name: Sarif
jobs:
  upload-sarif:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1.0.6 #@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
      - run: cargo run --release -- --src=. --output-format=sarif | tee results.sarif
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

After executing this workflow, the result will be displayed in the security tab under code scanning.

The rules in Phanalist also consist of detailed explanations written in Markdown, which are backed into the executable binary. This comes in very handy when scanning code. In Sarif, you can specify a Markdown for the result found when you ran your tool.

If I click and open one of the warnings, I will be greeted with a detailed explanation. Including the file and location that is causing the issue.

I hope you learned something useful and can now improve your CI output.

How I made it impossible to write spaghetti code. Part 2

Denzyl Dick — Mon, 22 Jan 2024 18:33:00 +0000

This is the part(3) of a series. I suggest you read parts 1 and 2 before this one.

If you have read part 1, you know that we need to implement the validate function that is mandatory in the trait Rule.


impl Rule for E009 {
    fn validate(
        &self,
        statement: &php_parser_rs::parser::ast::Statement,
    ) -> Vec<crate::project::Suggestion> {

    }
}

In part 2 we have learned that :

Nodes are like the conditional statement: if, else, while, for, etc.
Edges are the paths that can be taken.

The validate function will be executed for every statement in a source code. In the source code below, there are 32 lines of code.

<?php

class Index{

  public function tooComplex(){
    $a = 1;
    $b = 2;


    if($a > $b){
      if($b < $a){

        if($a == $b){

          while($b > $a){

          }

        }
      }
    }
  }
}

impl Rule for E009 {
    fn validate(
        &self,
        statement: &php_parser_rs::parser::ast::Statement,
    ) -> Vec<crate::project::Suggestion> {
        let mut suggestions = Vec::new();
        let mut graph = Graph { n: 0, e: 0, p: 0 };
        match statement {
            Statement::Class(class) => {
                for member in &class.body.members {
                    match member {
                        ClassMember::ConcreteMethod(concretemethod) => {
                            match concretemethod.body.clone() {
                                MethodBody {
                                    comments: _,
                                    left_brace: _,
                                    statements,
                                    right_brace: _,
                                } => {
                                   /// HERE !!
                                    }
                                }
                            }
                        }
                        _ => {}
                    }
                }
            }
            _ => {}
        }
        suggestions
    }
}

If you aren't familiar with pattern matching, it's kind of a switch keyword on steroids. Look for the Look for /// HERE !! in the above code.

 MethodBody {
                                    comments: _,
                                    left_brace: _,
                                    statements,
                                    right_brace: _,
                                } => {
                                    /// HERE 1

                                    }
                                }

As you can see we have four parameters that we can use. The ones we are looking for are the statements. The type of this parameter is Vec<Statement> meaning it can be anything.

Let's use the Graph we previously created in part 2


 let graph = calculate_cyclomatic_complexity(
                                        statements.clone(),
                                        &mut graph,
                                    );
 if graph.calculate() > 10 {
suggestions.push(Suggestion::from("This method body is too complex. Make it easier to understand.".to_string(),
                concretemethod.function,
"E009".to_string() ));
}

The Graph struct has the calculate function we previously used to calculate the cyclomatic complexity. My threshold is always ten, so I will be using that.

If the value exceeds ten, I push the Suggestion onto the vector. The vector of Suggestion is the value returned to the validate function's caller.

Recursion

In computer science, recursion is a method of solving a computational problem where the solution depends on solutions to smaller instances of the same problem. Recursion solves such recursive problems using functions that call themselves from within their code. Wikipedia

Conclusion

If you are a PHP developer, you know that a developer can make many more mistakes in PHP. In the future, the list of Rules will continue to grow into something more useful.

Thanks for reading!

Contribution is always welcome if you have a mistake you would like to add to Phanalist.

How I made it impossible to write spaghetti code.

Denzyl Dick — Sun, 21 Jan 2024 00:48:50 +0000

This is part 2 of a series of my static analyzer for PHP. If you did not read part 1, I suggest you to read it first.

A long time ago, I went to a development user group, and one of the talks was about cyclomatic complexity. At that time, I thought, what a cool name. If you already know the meaning of that cool name. Congrats, you are probably 1 of those developers who can detect lousy code without reading it. By seeing the indentation's shape, you can smell the bad code.

Cyclomatic definition:
Used to describe the number of circuits in a network; equal to the number of edges minus the number of nodes plus the number of graphs.

Ok, breathe. If we translate the definitions into code, it will be something like this.

Nodes are like the conditional statement: if, else, while, for, etc.
Edges are the paths that can be taken. There are two paths in the code on lines 4 and 14. One of the two can be taken if the variable defined on line 3 has the value of Hola; in this case, the first path will be taken. But in this example, the value of the $a is Helloworld so the second path will be taken. In the control flow graph below, you can view a better representation.

Ok, right; what is the complexity of that cool name I previously told you about?

The code above is a small example, but imagine you have a method that has 100 lines of code. Then, the complexity of the code will increase drastically.

Calculate the complexity

The equation for calculating the cyclomatic complexity is:

M = N - E + 2 P

This formula is also known as McCabe's Cyclomatic Complexity (MCC) and is widely used to measure the complexity of a program by analyzing its control flow structure.

N stands for the number of nodes, and E stands for the number of edges. The 2P stands for two multiplied by the number of exit nodes. In our example, this will translate into:

5 = 8 - 9 + 2 x 3

So, I started this blog by saying I can prevent myself from writing spaghetti code. If you did not read part 1 of this series, you might not know I'm working on a static analyzer for PHP. The project's name is phanalist, and it's available on github.

In the following paragraph, we will see how phanalist can calculate the cyclomatic complexity of the scope of a method. Before creating Phanalist, I always kept the cyclomatic complexity of the methods I wrote in my mind. And if I see that the complexity is higher than 10. I always try to refactor the method, making it easier to understand.

How does phanalist calculate the cyclomatic complexity? Let's start by implementing the equation above. We will start by creating a struct named Graph. This struct will have the three variables from the equation(n, e, and p).

struct Graph {
    n: i64,
    e: i64,
    p: i64,
}

This struct will be passed around when traversing the abstract syntax tree.

M = N - E + 2 P

When traversing the AST, we can increase the variables at the right moment. After that, I used the MCC equation to calculate the cyclomatic complexity of our example code.

impl Graph {
    pub fn calculate(self) -> i64 {
        self.n - self.e + (2 * self.p)
    }
}
#[test]
pub fn calculate() {
    let g = Graph { n: 8, e: 9, p: 3 };
    assert_eq!(g.calculate(), 5);
}

In part 1, I explained how to navigate the abstract syntax tree and how Phanalist generates one. If you missed it, I suggest you read that before reading the next part of the series.

In part 3 of this series. I will explain how we traverse the AST when calculating the cyclomatic complexity.