Coding-standard - Magento PHP CodeSniffer Coding Standard

Magento ECG

Last update: Jan 3, 2023

Related tags

Miscellaneous coding-standard

Overview

ECG Magento Code Sniffer Coding Standard

ECG Magento Code Sniffer Coding Standard is a set of rules and sniffs for PHP_CodeSniffer tool.

It allows automatically check your code against some of the common Magento and PHP coding issues, like:

raw SQL queries;
SQL queries inside a loop;
direct instantiation of Mage and Enterprise classes;
unnecessary collection loading;
excessive code complexity;
use of dangerous functions;
use of PHP Superglobals;

and many others.

Both Magento and Magento 2 are supported.

Installation

Before starting using our coding standard install PHP_CodeSniffer.

The recommended installation method for PHPCS is globally with Composer:

composer global require "squizlabs/php_codesniffer=*"

Make sure Composer's bin directory (defaulted to ~/.composer/vendor/bin/) is in your PATH.

Clone or download this repo somewhere on your computer or install it with Composer:

composer require magento-ecg/coding-standard

Note: PHP_CodeSniffer 3.x is now required to run our coding standard. To install PHP_CodeSniffer 2.x compatible version:

composer require magento-ecg/coding-standard:2.*

Note: Alternatively to installing PHP_CodeSniffer globally, you can include dependencies for both magento-ecg/coding-standard and squizlabs/php_codesniffer in your composer.json file. For example:

{
    "require": {
        "magento-ecg/coding-standard": ">=3.0",
        "squizlabs/php_codesniffer": "3.*"
    }
}

Usage

Select a standard to run with CodeSniffer:

Ecg for Magento
EcgM2 for Magento 2

Run CodeSniffer:

$ phpcs --standard=./vendor/magento-ecg/coding-standard/Ecg /path/to/code

$ phpcs --standard=./vendor/magento-ecg/coding-standard/EcgM2 /path/to/code

As a one time thing, you can add the ECG standards directory to PHP_CodeSniffer's installed paths:

$ phpcs --config-set installed_paths /path/to/your/folder/vendor/magento-ecg/coding-standard

After that specifying the path to a standard is optional:

$ phpcs --standard=Ecg /path/to/code

$ phpcs --standard=EcgM2 /path/to/code

PHP CodeSniffer will automatically scan Magento PHP files. To check design templates, you must specify phtml in the --extensions argument: --extensions=php,phtml.

Requirements

PHP 5.4 and up.

Checkout the php-5.3-compatible branch to get the PHP 5.3 version.

Contribution

Please feel free to contribute new sniffs or any fixes or improvements for the existing ones.

Comments

Fatal error - interface `PHP_CodeSniffer_Sniff` not found when using PHPCS 3.0.0-RC4

PHP Fatal error:  Interface 'PHP_CodeSniffer_Sniff' not found in vendor/magento-ecg/coding-standard/EcgM2/Sniffs/Plugins/PluginSniff.php on line 7

Clean Magento 2.1.6 (except for the upped version of PHPCS to 3.0.0-RC4, and added "magento-ecg/coding-standard": "dev-master#5f8143d94677d79bca6f428ad71da63214a2efeb" as a dev dependency)

mageinferno/magento2-php docker image which runs following commands:

composer install --no-interaction --no-progress --optimize-autoloader --no-ansi
php -d memory_limit=128M vendor/bin/phpcs app/code  --extensions=php,phtml --standard=./vendor/magento-ecg/coding-standard/EcgM2/

opened by erfanimani 8

Can't use EcgM2 with composer

I'm using EcgM2 and I tought that it would be nice to add it as a dependency with composer and setup with a custom phpcs.xml so that every one in the team can use it more easily.

But if I add this line in phpcs.xml <rule ref="./vendor/magento-ecg/coding-standard/EcgM2"/>

phpcs dies with this error: PHP Fatal error: Uncaught PHP_CodeSniffer_Exception: Referenced sniff "Ecg.Performance.CollectionCount" does not exist

While if I try to add Ecg it works (but since it is a Magento 2 project I don't need it)

opened by giacmir 8
No code style checks

I didn't follow the updates closely but for some reason the standard stopped doing code style checks for me. My guess is the version 2.x (2.3.0 as of now) of the phpcs

Ecg.Security.ForbiddenFunction and Ecg.Performance sniffs still run ok. Any clues are appreciated

opened by Zifius 6
Access level on Ecg_Sniffs_Security_ForbiddenFunctionSniff

Getting this error while trying to run phpcs with this standard. Registering sniffs in the Ecg standard... PHP Fatal error: Access level to Ecg_Sniffs_Security_ForbiddenFunctionSniff::$forbiddenFunctions must be public (as in class Generic_Sniffs_PHP_ForbiddenFunctionsSniff) in vendor/magento-ecg/coding-standard/Ecg/Sniffs/Security/ForbiddenFunctionSniff.php on line 4

I changed that class property to public and it runs fine.

opened by centerax 6

Referenced sniff "Ecg.Security.LanguageConstruct.DirectOutput" does not exist

Hi,

i wanted to use your project, to check my Magento module. However it doesn't work (i have tried both coding standards 1.2 version + php code sniffer 2.3.3 ... and latest versions from master - both have the same issue.

$ ../PHP_CodeSniffer-2.3.3/scripts/phpcs --standard=../coding-standard-1.2 ModuleName/ > standards2.txt

PHP Fatal error:  Uncaught exception 'PHP_CodeSniffer_Exception' with message 'Referenced sniff "Ecg.Security.LanguageConstruct.DirectOutput" does not exist' in /workspace/PHP_CodeSniffer-2.3.3/CodeSniffer.php:1092

Stack trace:
#0 /workspace/PHP_CodeSniffer-2.3.3/CodeSniffer.php(733): PHP_CodeSniffer->_expandRulesetReference(Object(SimpleXMLElement), '/workspace/...', 0)
#1 /workspace/PHP_CodeSniffer-2.3.3/CodeSniffer.php(551): PHP_CodeSniffer->processRuleset('/workspace/...')
#2 /workspace/PHP_CodeSniffer-2.3.3/CodeSniffer/CLI.php(818): PHP_CodeSniffer->initStandard(Array, Array)
#3 /workspace/PHP_CodeSniffer-2.3.3/CodeSniffer/CLI.php(95): PHP_CodeSniffer_CLI->process()
#4 /workspace/PHP_CodeSniffer-2.3.3/scripts/phpcs(25): PHP_CodeSniffer_CLI->runphpcs()
#5 {main}
  thrown in /workspace/PHP_CodeSniffer-2.3.3/CodeSniffer.php on line 1092

opened by josjed 5

Extending Zend standard

Hello.

I was thinking that this standard shouldn't be standalone, but extending the Zend one - with <rule ref="Zend"/>.

What do you think?

opened by adragus-inviqa 4
Context / Explanation for the Rules

Is there anywhere that actually explain why some of these things are errors or warnings? For example a common error I'm seeing amongst third party (and some of my own) modules is "The use of function curl_init() is forbidden". Why is this forbidden? I assume it's because you can't guarantee the curl extension is installed? What's the 'best practice' alternative that we should be doing? It's rather frustrating finding out your code isn't considered best practice but not being able to find out what the best practice is.

Whilst this isn't an 'issue' per se with this repo, I feel if such a thing does exist it should at least be referenced in the Readme.

opened by pocallaghan 4
Uncaught TypeError: vsprintf(): Argument #2 ($values) must be of type array, string given in vendor/squizlabs/php_codesniffer/src/Files/File.php:1056

getting an error when using EcgM2 standard in phpcs in magento 2.4

Fatal error: Uncaught TypeError: vsprintf(): Argument #2 ($values) must be of type array, string given in /var/www/html/vendor/squizlabs/php_codesniffer/src/Files/File.php:1056 Stack trace: #0 /var/www/html/vendor/squizlabs/php_codesniffer/src/Files/File.php(1056): vsprintf('Unescaped outpu...', '<?= json_encode...') #1 /var/www/html/vendor/squizlabs/php_codesniffer/src/Files/File.php(672): PHP_CodeSniffer\Files\File->addMessage(true, 'Unescaped outpu...', 8, 29, 'Unescaped outpu...', '<?= json_encode...', 5, false) #2 /var/www/html/vendor/magento-ecg/coding-standard/EcgM2/Sniffs/Templates/EscapedOutputSniff.php(84): PHP_CodeSniffer\Files\File->addError('Unescaped outpu...', 47, 'Unescaped outpu...', '<?= json_encode...') #3 /var/www/html/vendor/squizlabs/php_codesniffer/src/Files/File.php(498): EcgM2\Sniffs\Templates\EscapedOutputSniff->process(Object(PHP_CodeSniffer\Files\LocalFile), 47) #4 /var/www/html/vendor/squizlabs/php_codesniffer/src/Files/LocalFile.php(92): PHP_CodeSniffer\Files\File->process() #5 /var/www/html/vendor/squizlabs/php_codesniffer/src/Runner.php(628): PHP_CodeSniffer\Files\LocalFile->process() #6 /var/www/html/vendor/squizlabs/php_codesniffer/src/Runner.php(434): PHP_CodeSniffer\Runner->processFile(Object(PHP_CodeSniffer\Files\LocalFile)) #7 /var/www/html/vendor/squizlabs/php_codesniffer/src/Runner.php(114): PHP_CodeSniffer\Runner->run() #8 /var/www/html/vendor/squizlabs/php_codesniffer/bin/phpcs(18): PHP_CodeSniffer\Runner->runPHPCS() #9 /var/www/html/vendor/bin/phpcs(117): include('/var/www/html/v...') #10 {main} thrown in /var/www/html/vendor/squizlabs/php_codesniffer/src/Files/File.php on line 1056

opened by palakaccorin 3
Can you please do more frequest releases?

Is the release schedule of this repo tied to the M2 one? I'd rather this one be separate and have small, but more frequent tags/release, so we can use it via composer in a more elegant way, not using master.

opened by adragus-inviqa 3
Alternative for forbidden function constant()

According to Ecg_Sniffs_Security_ForbiddenFunctionSniff the function constant() is forbidden. I'm unable to find a replacement within the core or lib, and also wonder why its forbidden. What would be an alternative function or method to use?

opened by Vinai 3
Empty diff

I tryed the standard Ecg on a Magento 1.9 custom Module. The stdout report works as expected and spots many Warning and Errors. Then I tryed to generate a diff file to eventually patch the code in the future, though mostly to browse what kind of modifications the standard would apply. But the resulting diff file is empty.

This is the command I used:

phpcs --report-diff=phpcs.diff --standard=Ecg .

I tryed the same command with different standard:

phpcs --report-diff=phpcs.diff --standard=PSR2 .

And it produce the desired diff file.

opened by endersaka 2

Internal error fo do...while

do {
    ...
} while (...);

leads to

----------------------------------------------------------------------
FOUND 1 ERROR AFFECTING 1 LINE
----------------------------------------------------------------------
 1 | ERROR | An error occurred during processing; checking has been
   |       | aborted. The error message was: Undefined array key
   |       | "parenthesis_opener" in
   |       | xxx/vendor/magento-ecg/coding-standard/Ecg/Sniffs/Performance/LoopSniff.php
   |       | on line 73 (Internal.Exception)
----------------------------------------------------------------------

opened by sreichel 0

Releases(4.5.2)

4.5.2(Dec 6, 2022)

Apply patch to Support php8.0 for OpenMage
Source code(tar.gz)
Source code(zip)
4.5.1(Sep 2, 2022)

Source code(tar.gz)
Source code(zip)
4.5.0(Jan 29, 2022)

Update documentation
Source code(tar.gz)
Source code(zip)
4.4.4(Jan 28, 2022)

Source code(tar.gz)
Source code(zip)
4.4.3(Jan 28, 2022)

Source code(tar.gz)
Source code(zip)
4.4.0(Jan 28, 2022)

Source code(tar.gz)
Source code(zip)
4.3(Jan 28, 2022)

Source code(tar.gz)
Source code(zip)
4.1(Jan 28, 2022)

Source code(tar.gz)
Source code(zip)
4.0(Jan 28, 2022)
New Magento2 Commerce Sniffers

Object Manager

Escape Methods

Template expirieince

What's Changed

Revert "Add PHP_Codesniffer to require" by @zlik in https://github.com/magento-ecg/coding-standard/pull/55

Fix tiny typo :) by @diazwatson in https://github.com/magento-ecg/coding-standard/pull/56

Add Composer package type by @macieklewkowicz in https://github.com/magento-ecg/coding-standard/pull/61

Add ExtND rules to EcgM2 ruleset. by @zhooravlik in https://github.com/magento-ecg/coding-standard/pull/62

Ecgm2 added extdn rules by @zhooravlik in https://github.com/magento-ecg/coding-standard/pull/63

Ecgm2 added extdn rules by @zhooravlik in https://github.com/magento-ecg/coding-standard/pull/64

New Contributors

@zlik made their first contribution in https://github.com/magento-ecg/coding-standard/pull/55

@diazwatson made their first contribution in https://github.com/magento-ecg/coding-standard/pull/56

@macieklewkowicz made their first contribution in https://github.com/magento-ecg/coding-standard/pull/61

@zhooravlik made their first contribution in https://github.com/magento-ecg/coding-standard/pull/62

Full Changelog: https://github.com/magento-ecg/coding-standard/compare/3.1...4.0
Source code(tar.gz)
Source code(zip)
3.0(Jun 17, 2017)

Source code(tar.gz)
Source code(zip)
2.1(Jun 17, 2017)

Includes bugfixes since release 2.0
Source code(tar.gz)
Source code(zip)
2.0(Dec 18, 2015)

Added rules and sniffs for Magento 2.
Source code(tar.gz)
Source code(zip)
1.2(Apr 27, 2015)

Support checking Magento design templates. phtml extension should be specified in --extension argument then running CodeSniffer.
Source code(tar.gz)
Source code(zip)
1.1(Jan 14, 2015)

Compatibility with PHP CodeSniffer v.2.x.
Source code(tar.gz)
Source code(zip)
1.0(Nov 13, 2014)

Source code(tar.gz)
Source code(zip)