DEV Community: Satoshi Nishimura

Checks calling echo with no htmlspecialchars when using pure PHP as template with PHPStan

Satoshi Nishimura — Mon, 23 Dec 2019 02:25:43 +0000

The only and greatest benefit of using a template engine library with PHP is that it runs htmlspecialchars without omission.

https://github.com/phpstan/phpstan/issues/351#issuecomment-381421561

As commented in this issue, I partially agree with using standard PHP classes for type checking.
Partial means that I want to write a mixed HTML and PHP template as shown below.

<?php

namespace App;

class ProductDto
{
    /** @var int */
    public $product_id;
    /** @var string */
    public $name;
    /** @var ?string */
    public $description;
}

<?php
namespace App;
class ProductHtml {
    public function view(ProductDto $product): void {
?>

<div>
  <div>
    <?= $product->product_id ?>
  </div>
  <div>
    <?= $product->name ?>
  </div>
  <div>
    <?= $product->description ?>
  </div>
</div>

<?php
    }
}

PHPStan (or rather PHP-Parser) correctly parses PHP with mixed HTML.
The only complaint about this way is that it cannot check htmlspecialchars exhaustively.
For example, <? = $ Product-> description?> May cause XSS.
PHPStan has a plugin mechanism, so we decided to add a htmlspecialchars check as a trial.

nishphp / phpstan-echo-html-rule

htmlspecialchars checker for PHPStan

PHPStan Echo Html Rule Extension

This package is a PHPStan extension for checking whether htmlspecialchars is called from a pure PHP template.

Install

composer require --dev nish/phpstan-echo-html-rule

How to use

Add to phpstan.neon

includes:
  - vendor/nish/phpstan-echo-html-rule/rules.neon

If your composer.json is:

    "autoload": {
        "psr-4": { "App\\": "src" },
        "files": [
            "src/functions.php"
        ]
    },

Value Object class src/ProductDto.php:

<?php

namespace App;

class ProductDto
{
    /** @var int */
    public $product_id;
    /** @var string */
    public $name;
    /** @var ?string */
    public $description;
}

Html Template src/ProductHtml.php:

<?php
namespace App
class ProductHtml {
    public function view(ProductDto $product): void {
?>

<div>
  <div>
    <?= $product->product_id ?>
  </div>
  <div>
    <?= $product->name ?>
  </div>
  <div>
    <?= $product->description ?>
  </div>
</div>

<?php
    }

…

View on GitHub

Adding this extension will report an error similar to the following:

 3/3 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%

 ------ ---------------------------------------------------- 
  Line   ProductHtml.php                                     
 ------ ---------------------------------------------------- 
  16     Parameter #1 (string) is not safehtml-string.       
  19     Parameter #1 (string|null) is not safehtml-string.  
 ------ ---------------------------------------------------- 


 [ERROR] Found 2 errors

htmlspecialchars needs return safehtml-string because the extension added a virtual type safehtml-string.

<?php

/**
 * @param int|string|null $input
 * @return safehtml-string
 */
function h($input)
{
    return htmlspecialchars((string)$input);
}

/**
 * @param int|string|null $input
 * @return safehtml-string
 */
function raw($input)
{
    return (string)$input;
}

Then, correct the part that caused the error.

<?php
namespace App;
class ProductHtml {
    public function view(ProductDto $product): void {
?>

<div>
  <div>
    <?= $product->product_id ?>
  </div>
  <div>
    <?= h($product->name) ?>
  </div>
  <div>
    <?= h($product->description) ?>
  </div>
</div>

<?php
    }
}

All other echo calls that do not use htmlspecialchars are now reported as errors too.

Tried FFI on PHP 7.4

Satoshi Nishimura — Sat, 18 May 2019 06:58:59 +0000

Getting PHP 7.4 and check the launch

I tried FFI on PHP 7.4.

First, get php sources and compile. Needs configure with --with-ffi option.

git clone https://github.com/php/php-src.git
cd php-src
git checkout PHP-7.4
./configure --with-ffi
make

Starting server with FFI needs ffi.enable=1 definition.

php-src/sapi/cli/php -d ffi.enable=1 -S localhost:8000

When the server is up, first copy the example here https://php.net/ffi.examples-basic and make sure there are no errors.

Make shared library by C language for FFI

After launch PHP 7.4, make shared library by c language.

#include <string.h>

#define BUF_SIZE 1024

const char * sample(const char *data, int mod)
{
  char buf[BUF_SIZE];
  const char * ret = buf;
  int i;

  for (i = 0; i <= strlen(data) && i < BUF_SIZE; i++){
    if (data[i] >= 97 && data[i] <= 122 && i % mod == 0)
      buf[i] = data[i] - 32;
    else
      buf[i] = data[i];
  }

  return ret;
}

This is the simple program that getting string and int arguments and converting to upper case.

Compile the program to shared library, and load from php program.

gcc -shared -o libsample.so sample.c

<?php
header('Content-Type: text/plain');

$ffi = FFI::cdef("

const char * sample(const char *data, int mod);

", __DIR__ . '/libsample.so');

var_dump($ffi);
var_dump($ffi->sample("sample test test", 3));
var_dump($ffi->sample("sample test test", 4));
var_dump($ffi->sample("sample test test", 1));

/* output:

object(FFI)#1 (0) {
}
string(16) "SamPle teSt TesT"
string(16) "SampLe tEst Test"
string(16) "SAMPLE TEST TEST"
*/

It worked well!

PHP's string type variables can be received in C as const char * type variables.
It seems to be required const.
PHP int type variable is int type variable also in C.

Use a callback function

Currently, the callbacks in the PHP manual are described by zend_write, but I think it's not so clear.
https://php.net/ffi.examples-callback

So, I wrote a original callback program to make it easy to understand.

#include <string.h>

#define BUF_SIZE 1024

typedef int (*callback_t)(int);

const char * sample(const char *data, callback_t callback)
{
  char buf[BUF_SIZE];
  const char * ret = buf;
  int i;

  for (i = 0; i <= strlen(data) && i < BUF_SIZE; i++){
    if (data[i] >= 97 && data[i] <= 122 && callback(i))
      buf[i] = data[i] - 32;
    else
      buf[i] = data[i];
  }

  return ret;
}

Tried the behavior that PHP closure is mapped to C function pointer.
This program uses a simple callback function that receives int argument and returns int.

Here is an example using a structure, callback and reference:

<?php
header('Content-Type: text/plain');

$ffi = FFI::cdef("

typedef int (*callback_t)(int);
const char * sample(const char *data, callback_t callback);

", __DIR__ . '/libsample.so');

var_dump($ffi);
var_dump($ffi->sample("sample test test", fn($i) => $i % 3));
var_dump($ffi->sample("sample test test", fn($i) => $i % 4));
var_dump($ffi->sample("sample test test", fn($_) => true));

/* output:

object(FFI)#1 (0) {
}
string(16) "sAMpLE TEsT tESt"
string(16) "sAMPlE TeST tEST"
string(16) "SAMPLE TEST TEST"
*/

Now that the Arrow Functions function has been merged, can use it.

Callback function cannot return string type. When try it, raised error that Uncaught FFI\Exception: FFI internal error. Unsupported return type.

Use struct of C language

Structures can be used by calling FFI :: cdef with a structure declaration.

#include <string.h>

#define BUF_SIZE 1024

typedef int (*callback_t)(int);
struct cbdata {
  callback_t f;
};

const char * sample(const char *data, struct cbdata *cbdata)
{
  char buf[BUF_SIZE];
  const char * ret = buf;
  int i;

  for (i = 0; i <= strlen(data) && i < BUF_SIZE; i++){
    if (data[i] >= 97 && data[i] <= 122 && cbdata->f(i))
      buf[i] = data[i] - 32;
    else
      buf[i] = data[i];
  }

  return ret;
}

<?php
header('Content-Type: text/plain');

$ffi = FFI::cdef("

typedef int (*callback_t)(int);
struct cbdata {
  callback_t f;
};

const char * sample(const char *data, struct cbdata *cbdata);

", __DIR__ . '/libsample.so');

$cbdata = $ffi->new('struct cbdata');
$n = 3;
$cbdata->f = function($i) use(&$n){
    return $i % $n === 0;
};

$pcbdata = FFI::addr($cbdata);

var_dump($ffi->sample("sample test test", $pcbdata));

$n = 4;
var_dump($ffi->sample("sample test test", $pcbdata));

$n = 1;
var_dump($ffi->sample("sample test test", $pcbdata));

/* output:

string(16) "SamPle teSt TesT"
string(16) "SampLe tEst Test"
string(16) "SAMPLE TEST TEST"
 */

From PHP references can be used from callbacks from C functions, it seems possible to execute C functions while changing values at any time.

Use another language

If I want to execute numerical calculation at high speed, it may be better in C language, but I do not want to do string processing in C.
If other languages have FFI, they can communicate through FFI.

{-# LANGUAGE ForeignFunctionInterface #-}

#include "template_operations.h"

module HaskellPhp where

import Foreign
import Foreign.C.String
import Foreign.C.Types

data Tops = Tops { assign::FunPtr (CString -> CString -> IO CInt) }

foreign export ccall hsParse :: CString -> Ptr Tops -> IO CString
foreign import ccall "dynamic" mkFun :: FunPtr (CString -> CString -> IO CInt)
                                     -> (CString -> CString -> IO CInt)
foreign import ccall "assign_value_get" value_get :: IO CString



instance Storable Tops where
    sizeOf _ = #size CTOPS
    alignment _ = #alignment CTOPS
    peek ptr = do
      assign' <- (#peek CTOPS, assign) ptr
      return Tops { assign=assign' }
    poke ptr (Tops assign') = do
                           (#poke CTOPS, assign) ptr assign'


--
-- Function to parse some string
--
hsParse :: CString -> Ptr Tops -> IO CString
hsParse cs cops = do
  ops <- peek cops
  let f = mkFun $ assign ops
  a <- newCString "foo"
  b <- newCString "bar"
  r <-  f a b
  cstr <- value_get
  s <- peekCString cstr
  newCString $ "hsParse finish: [" ++ show r ++ "]" ++ "[" ++ s ++ "]"

typedef struct template_operations
{
  size_t (*assign)(const char * key, const char * value);
} CTOPS;

#include <stdio.h>
#include <HsFFI.h>

#ifdef __GLASGOW_HASKELL__
#include "Callback_stub.h"
#endif

#include "template_operations.h"

int prepare() {
  hs_init(0,0);
}
int finish() {
  hs_exit();
}

static const char * assign_string = "";
void assign_value_set(const char *value)
{
  assign_string = value;
}
const char *assign_value_get()
{
  return assign_string;
}

const char* parse(char *data, struct template_operations *tops)
{
  return hsParse(data, tops);
}

<?php
header('Content-Type: text/plain');
$ffi = FFI::cdef('
int prepare();
int finish();

typedef struct template_operations
{
  size_t (*assign)(const char * key, const char * value);
} CTOPS;

const char* parse(char *data, struct template_operations *tops);
void assign_value_set(const char *value);
const char * assign_value_get();

', __DIR__ . '/libcallback.so');

$ffi->prepare();

$tops = $ffi->new('struct template_operations');
$tops->assign = function($key, $value) use ($ffi){
    $value = "$key = $value";
    $ffi->assign_value_set($value);

    // Notice:
    // return string value is not supported
    return strlen($value);
};

$data = '<div>$foo</div>';
$ret = $ffi->parse($data, FFI::addr($tops));

var_dump($ffi->assign_value_get());
var_dump($ret);

$ffi->finish();

/* Output

string(9) "foo = bar"
string(30) "hsParse finish: [9][foo = bar]"

 */

Here is an example using Haskell.
It assumes that Haskell will create a templating engine from which to interact with PHP.
Use hsc2hs to use ffi in haskell.

Since the return value can not be a string type, I made it a global variable of C language.
PHP is not originally thread safe, there is no problem, isn't it? maybe...

If it write up to this point, it can call Haskell directly without using C language.

{-# NOINLINE return_value #-}
return_value :: IORef CString
return_value = unsafePerformIO $ newCString "" >>= newIORef

return_value_set :: CString -> IO ()
return_value_set a = writeIORef return_value a

return_value_get :: IO CString
return_value_get = readIORef return_value

<?php
header('Content-Type: text/plain');
$ffi = FFI::cdef('
int hs_init(int *, char **[]);
int hs_exit();

typedef struct template_operations
{
  size_t (*assign)(const char * key, const char * value);
} CTOPS;

const char* parse(char *data, struct template_operations *tops);
void return_value_set(const char *value);
const char * return_value_get();

', __DIR__ . '/libcallback.so');

$argc = FFI::new('int');
$argv = FFI::new('char[0]');
$pargv = FFI::addr($argv);
$ffi->hs_init(FFI::addr($argc), FFI::addr($pargv));

$tops = $ffi->new('struct template_operations');
$tops->assign = function($key, $value) use ($ffi){
    $value = "$key = $value";
    $ffi->return_value_set($value);

    // Notice:
    // return string value is not supported
    return strlen($value);
};

$data = '<div>$foo</div>';
$ret = $ffi->parse($data, FFI::addr($tops));

var_dump($ffi->return_value_get());
var_dump($ret);


$ffi->hs_exit();


/* Output

string(9) "foo = bar"
string(30) "hsParse finish: [9][foo = bar]"

 */

Conclusion

The sample programs I wrote so far are located here:

nishimura / php_ffi_samples

PHP FFI Samples

2019/05/18

Compile PHP 7.4

mkdir work
cd work

git clone https://github.com/php/php-src.git
cd php-src
git checkout PHP-7.4
./configure --with-ffi
make

cd ..

Checkout Samples

git clone https://github.com/nishimura/php_ffi_samples.git

Start Server with FFI

cd php_ffi_samples
../php-src/sapi/cli/php -d ffi.enable=1 -S localhost:8000

# and access to
#   http://localhost:8080/
#   http://localhost:8080/1/
#   ...

Create DSO Module

require: c build tools

cd 2
make

# and access to
#   http://localhost:8080/2/

Other Samples

3: call with closure argument
4: c struct, php reference and callback
5: FFI bridge
6, 7: call haskell functions directly

FFI Bridge to Haskell

require: haskell build tools (ghc)

sample5

PHP => FFI C => FFI Haskell => Callback C => Callback PHP => Set c variable instead of return value

sample6, sample7

PHP => FFI Haskell Callback PHP => Set haskell IORef instead of return value

View on GitHub

By using FFI, PHP is dedicated to form manipulation and DB calls, and logic can be written in any language you like, such as Haskell, Go, Rust!

Simple Auto Wiring Container

Satoshi Nishimura — Thu, 25 Oct 2018 12:12:55 +0000

I did not need a DI container but needed auto wiring container.
Originally, I divided the container class I used with my own framework.

nishphp / simple-container

Simple Auto Wiring Container

simple-container

Simple container of auto wiring with constructor.

<?php
use Nish\Container\Container
require_once 'vendor/autoload.php'
$c = Container::getInstance()
$obj = $c->get(stdClass::class)
$c->call(Foo::class, 'staticMethod');

$foo = new Foo();
$c->call($foo, 'method');

$c->setFactory('MyClass', function($c){
    return new MyClass('custom param');
});
$c->setFactory(MyClass::class, function($c){
    $obj = new MyClass('custom param');
    $c->set(MyClass::class, $obj); // singleton
    return $obj;
});

// set arguments
namespace MyProject;
class Db {
    private $dsn;
    public function __construct(string $dsn){
        $this->dsn = $dsn;
    }
    // ...
}

…

View on GitHub

This container class has only the basic methods that I actually use in the project.

The implementation of the interface is registered by the set method, and the dependency is written PHP code to the setFactory method.
However, most dependencies will be solved with the Auto Wiring.

class Foo
{
    private $obj;
    public function __construct(stdClass $obj)
    {
        $this->obj = $obj;
    }
}

$c = Container::getInstance();
$foo = $c->get(Foo::class); // constructor injection, no config


// set implements
interface Uri {}
class MyUri implements Uri {}

$c->set(Uri::class, new MyUri);
$uri = $c->get(Uri::class);

// or
$c->setFactory(Uri::class, function($c){
    return new MyUri();
});

// singleton
$c->setFactory(Uri::class, function($c){
    $myUri = new MyUri();
    $c->set(Uri::class, $myUri);
    return $myUri;
});

When using Auto Wiring in a method call, you need to call the call method manually.

class MyIndexAction
{
    public static function index(Request $req, Response $res, MyForm $myForm)
    {
        // ...
    }

    public function __construct(MyForm $myForm) { $this->myForm = $myForm; }
    public function index2(Request $req, Response $res)
    {
        // ...
    }
}

$c->call(MyIndexAction::class, 'index');

// or
$action = $c->get(MyIndexAction::class);
$c->call($action, 'index2');

Most of the functions of this container are explained in these samples.
Simple but when combined with FastRoute, session libraries, etc., a simple micro framework is completed without a moment.

NOTE: I do not know if this program can be used in actual projects. I am trying it.