PHPSA - Smart Analyzer for PHP

Overview

Logo

PHPSA - Smart Analyzer for PHP

Build Status Scrutinizer Code Quality Code Coverage Latest Stable Version License

PHPSA is a development tool aimed at bringing complex analysis for PHP applications and libraries.

P.S This software is currently in early alpha state, any contributions/stars will be awesome.

Components

  • Core - Component containing definitions and other core files
  • Compiler - Component to compile expression(s) and statement(s) from an abstract syntax tree
  • Analyzer - Component doing various checks on your files
  • ControlFlow - Component for ControlFlow (WIP)

Installation (more)

The recommended way to install phpsa is via Composer.

Run php composer.phar require ovr/phpsa or add a new requirement in your composer.json.

{
  "require": {
    "ovr/phpsa": "*"
  }
}

How to use (more)

$ ./bin/phpsa check fixtures/

Syntax error:  Syntax error, unexpected T_RETURN on line 11 in fixtures/simple/syntax/Error2.php 

    $b = $a + 1; 123123

Notice:  Constant BBBB does not exist in self scope in fixtures/simple/undefined/Const.php on 29 [undefined-const]

    return self::BBBB; 

Notice:  You are trying to cast 'string' to 'string' in fixtures/simple/code-smell/StandardFunctionCall.php on 16 [stupid.cast]

    return (string) json_encode(array(

Notice:  Missing docblock for callStaticMethodBySelf() method in fixtures/Compiling/Expression/StaticCall.php on 18 [missing-docblock]

    public static function callStaticMethodBySelf()

Requirements

PHP >= 7.0, but you can check files that use PHP >= 5.2 with this.

Documentation

See our documentation in case you need more information on some topic.

Contributing

Check our Contributing Guide to see how you can help.

Sponsors

Thanks to our sponsors and supporters:

JetBrains

LICENSE

This project is open-sourced software licensed under the MIT License.

See the LICENSE file for more information.

Comments
  • [Docs] Start working on documentation

    [Docs] Start working on documentation

    • [x] Infos what does each component (Compiler, Analyzer, CFG, Definitions?)
    • [x] Infos what each analyzer does
    • [x] Infos on configuration (PR from @K-Phoen )
    • [x] How to write an own analyzer?
    • [x] Update Readme.md (make it shorter, link to docs and contributing guide)
    • [x] Check spelling and grammar (we have no native english speaker currently, so this would be really appreciated)
    • [ ] Just try some things out we are happy for every PR to docs :cake:

    What do you think? @ovr @K-Phoen I thought we'd do it like php-parser (doc directory)

    help wanted hacktoberfest 
    opened by ddmler 11
  • fix typo on line 50

    fix typo on line 50

    Hey!

    Type: documentation

    Link to issue: per comment on PR #189

    This pull request affects the following components (please check boxes):

    • [ ] Core
    • [ ] Analyzer
    • [ ] Compiler
    • [ ] Control Flow Graph
    • [x] Documentation

    In raising this pull request, I confirm the following (please check boxes):

    • [x] I have read and understood the Contributing Guidelines.
    • [x] I have checked that another pull request for this purpose does not exist.
    • [ ] I wrote some tests for this PR.

    Small description of change:

    Thanks

    opened by chasingSublimity 10
  • Add core unit tests (#170)

    Add core unit tests (#170)

    Hey!

    Type: code quality

    Link to issue: #170

    This pull request affects the following components: (please check boxes)

    • [X] Core
    • [ ] Analyzer
    • [ ] Compiler
    • [ ] Control Flow Graph
    • [ ] Documentation

    In raising this pull request, I confirm the following (please check boxes):

    • [X] I have read and understood the Contributing Guidelines?
    • [X] I have checked that another pull request for this purpose does not exist.
    • [X] I wrote some tests for this PR.

    Small description of change: Added core unit tests for IssuesCollector, ScopePointer and Application

    Thanks

    opened by DannyvdSluijs 10
  • Allow analyzers to be configured

    Allow analyzers to be configured

    I implemented a simple way to make analyzers configurable.

    They can define their own configuration, that will be merged in the global one. This configuration is used to determine if the analyzer pass is enabled or not. When the analyzer is instantiated, its configuration is injected through the constructor.

    I also added a new command to dump the default configuration: ./bin/phpsa config:dump-reference

    WDYT?

    opened by K-Phoen 9
  • fatal: Not a git repository

    fatal: Not a git repository

    When I run phpsa ( >vendor/ovr/phpsa/bin/phpsa check file.php ) I get the findings from the analysis but I also get lines saying: fatal: Not a git repository (or any of the parent directories): .git. I am new to composer and phpsa so I could have something configured incorrectly. Any help would be great.

    opened by 3cooper 9
  • [Config][Question] No option for ArrayDimFetch (array_dim_fetch_on_non_array)?

    [Config][Question] No option for ArrayDimFetch (array_dim_fetch_on_non_array)?

    It seems that I cannot enable or disable the array_dim_fetch_on_non_array future of this tool, is this correct? I tried disabling array_illegal_offset_type as that is the only class that contains a reference to ArrayDimFetch, but that didn't disable the analysis.

    Things I've tried to disable the analysis:

    • Add array_dim_fetch to the config
      • This resulted in an error (Unrecognized option "array_dim_fetch" under "phpsa.analyzers")
    • Disable all the array related actions
    • Disable all analyzers

    I did look through the codebase and I know that the config is handled by the Analyzer/Factory-class but I can't figure out where to go from there.

    opened by ghost 8
  • Specify which files to be ignored in check

    Specify which files to be ignored in check

    Type: new feature

    Link to issue: https://github.com/ovr/phpsa/issues/344

    This pull request affects the following components (please check boxes):

    • [x] Core
    • [ ] Analyzer
    • [ ] Compiler
    • [ ] Control Flow Graph
    • [ ] Documentation

    In raising this pull request, I confirm the following (please check boxes):

    • [x] I have read and understood the Contributing Guidelines.
    • [x] I have checked that another pull request for this purpose does not exist.
    • [x] I wrote some tests for this PR.

    Small description of change:

    First attempt to provide files and folders ignoring mechanism

    Thanks

    opened by kilgaloon 7
  • [Bug] False positive list(array.illegal_offset_type/undefined-variable/unused-variable)

    [Bug] False positive list(array.illegal_offset_type/undefined-variable/unused-variable)

    <?php
    class C
    {
        // Notice:  Illegal array offset type unknown for key $key. [array.illegal_offset_type]
        public function testForeach(array $ary)
        {
            foreach ($ary as $key => $value) {
                $ary[$key] = 1;
            }
        }
        // Notice:  You are trying to use an undefined variable $_SERVER [undefined-variable]
        public function testUndefinedSuperglobals($subject)
        {
            sprintf('%s', implode(' ', $_SERVER['argv']));
        }
        // Warning:  Unused variable $var in method testUnusedInIssetInFetch() [unused-variable]
        public function testUnusedInIssetInFetch(array $ary)
        {
            $var = 0;
            isset($ary[$var]);
        }
        // Warning:  Unused variable $thisClass in method testUnusedInNewOp() [unused-variable]
        public function testUnusedInNewOp($value)
        {
            $thisClass = get_class($this);
            return new $thisClass($value);
        }
    }
    
    bug help wanted 
    opened by algo13 7
  • [Analyzer] Property definition default value

    [Analyzer] Property definition default value

    Hey!

    Type: new feature| documentation

    Link to issue: https://github.com/ovr/phpsa/issues/166

    This pull request affects the following components (please check boxes):

    • [ ] Core
    • [x] Analyzer
    • [ ] Compiler
    • [ ] Control Flow Graph
    • [x] Documentation

    In raising this pull request, I confirm the following (please check boxes):

    • [x] I have read and understood the Contributing Guidelines.
    • [x] I have checked that another pull request for this purpose does not exist.
    • [x] I wrote some tests for this PR.

    Small description of change: This adds an analyzer which use of non-required default value for property. (PropertyProperty is not being registered)

    Thanks

    opened by deepvyas 7
  • Unexpected use of this

    Unexpected use of this

    I started to work on an implementation of unexpected uses of $this (#68).

    Most of the easy cases are covered and I'd like your feedback on this PR as I'm not familiar with this project (yet). Am I going in the right direction? If yes, I'll try to detect more error cases and add a few unit tests.

    opened by K-Phoen 7
  • Fatal error: Uncaught TypeError

    Fatal error: Uncaught TypeError

    When I run vendor/bin/phpsa check I get the following error:

    Fatal error: Uncaught TypeError: Argument 1 passed to PHPSA\Configuration::__construct() must be of the type array, null given, called in /app/vendor/ovr/phpsa/src/Command/AbstractCommand.php on line 48 and defined in /app/vendor/ovr/phpsa/src/Configuration.php:34
    Stack trace:
    #0 /app/vendor/ovr/phpsa/src/Command/AbstractCommand.php(48): PHPSA\Configuration->__construct(NULL, Array, NULL)
    #1 /app/vendor/ovr/phpsa/src/Command/CheckCommand.php(75): PHPSA\Command\AbstractCommand->loadConfiguration('.phpsa.yml', '/app')
    #2 /app/vendor/symfony/console/Command/Command.php(252): PHPSA\Command\CheckCommand->execute(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
    #3 /app/vendor/symfony/console/Application.php(865): Symfony\Component\Console\Command\Command->run(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
    #4 /app/vendor/symfony/console/Application.php(241): Symfony\Component\Console\Application->doRunCommand(Obj in /app/vendor/ovr/phpsa/src/Configuration.php on line 34
    

    I don't have a .phpsa.yml in my project. Do I need one? Should PHPSA work without a .phpsa.yml?

    bug 
    opened by EvgenyOrekhov 6
  • Some issues were closed and merged to master but i still can encounter those issues

    Some issues were closed and merged to master but i still can encounter those issues

    Such as #286 , it was closed on 2016,but now i still can reproduce: Notice: Undefined property: PhpParser\Node\Expr\ArrayDimFetch::$name in C:\ProgramData\ComposerSetup\bin\vendor\ovr\phpsa\src\Analyzer\Pass\Statement\UnexpectedUseOfThis.php on line 186 Notice: It's not possible to fetch an array element on a non array in E:********* on 168 [language_error] unset($seatNewArr[$key]);**

    bug 
    opened by armoour 6
  • Checking for the version throws error

    Checking for the version throws error

    If I run the --version command, phpsa is looking for git. If git is available, it will throw the error fatal: Not a git repository (or any of the parent directories): .git, which seems to be the same error as #102, but for another command.

    opened by MetalArend 0
  • Update dependencies

    Update dependencies

    • [x] Remove support for PHP version 5.6 (it seems we always support the last 3 php versions and so does php-parser)
    • [x] Update PHPUnit to version 6.x (needs php 7.0 and up)
    • [ ] Update php-parser to version 4.x (currently alpha and needs php 7.0 and up)
    help wanted 
    opened by ddmler 6
  • Technically valid PHP code causes fatal error

    Technically valid PHP code causes fatal error

    If I have a class that contains something like this:

    class Something
    {
        // ...
        private static $propOne, $propTwo;
        // ...
    }
    

    What happens is that after parsing, the resulting ClassDefinition contains both properties, but only one property statement (named for only $propTwo, incidentally).

    So far, this partly seems to make sense, but the problem comes in PHPSA\Compiler\Expression\StaticPropertyFetch::compile() which has the following code:

    // ...
    if (!$classDefinition->hasProperty($name, true)) {
        // return;
    }
    $property = $classDefinition->getPropertyStatement($name, true);
    if (!$property->isStatic()) { // <<<< LINE 46
        // ...
    }
    // ...
    

    With the code sample given above, hasProperty() returns true for $propOne, making it skip the first if block. Then, because there is no property statement named for $propOne, calling getPropertyStatement() returns null. So, on line 46, $property is set to null, making the call to isStatic() cause a fatal error.

    bug 
    opened by garrettw 3
Releases(0.6.2)
Owner
Dmitry Patsura
Junior erlang developer @cube-js
Dmitry Patsura
A static analyzer for PHP version migration

PHP Migration Readme in Chinese 中文 This is a static analyzer for PHP version migration and compatibility checking. It can suppose your current code ru

Yuchen Wang 194 Sep 27, 2022
SonarPHP: PHP static analyzer for SonarQube & SonarLint

Code Quality and Security for PHP This SonarSource project is a static code analyser for PHP language used as an extension for the SonarQube platform.

SonarSource 343 Dec 25, 2022
The Exakat Engine : smart static analysis for PHP

Exakat The Exakat Engine is an automated code reviewing engine for PHP. Installation Installation with the phar Phar is the recommended installation p

Exakat 370 Dec 28, 2022
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

PHPMD PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly

PHP Mess Detector 2.1k Jan 8, 2023
A PHP parser written in PHP

PHP Parser This is a PHP 5.2 to PHP 8.0 parser written in PHP. Its purpose is to simplify static code analysis and manipulation. Documentation for ver

Nikita Popov 15.9k Jan 3, 2023
A PHP VM implementation in PHP

PHPPHP A PHP VM implementation written in PHP. This is a basic VM implemented in PHP using the AST generating parser developed by @nikic To see what's

Anthony Ferrara 801 Dec 25, 2022
PHP Architecture Tester - Easy to use architectural testing tool for PHP :heavy_check_mark:

Easy to use architecture testing tool for PHP Introduction ?? PHP Architecture Tester is a static analysis tool to verify architectural requirements.

Carlos A Sastre 765 Dec 30, 2022
Provides functionality that helps writing PHP code that has runtime-specific (PHP / HHVM) execution paths

sebastian/environment This component provides functionality that helps writing PHP code that has runtime-specific (PHP / HHVM) execution paths. Instal

Sebastian Bergmann 6.5k Jan 3, 2023
Search PHP source code for function & method calls, variables, and more from PHP.

Searching PHP source code made easy Search PHP source code for function & method calls, variable assignments, classes and more directly from PHP. Inst

Permafrost Software 22 Nov 24, 2022
A full-scale PHP sandbox class that utilizes PHP-Parser to prevent sandboxed code from running unsafe code

A full-scale PHP 7.4+ sandbox class that utilizes PHP-Parser to prevent sandboxed code from running unsafe code. It also utilizes FunctionParser to di

Corveda 192 Dec 10, 2022
A tool to automatically fix PHP Coding Standards issues

PHP Coding Standards Fixer The PHP Coding Standards Fixer (PHP CS Fixer) tool fixes your code to follow standards; whether you want to follow PHP codi

null 11.6k Jan 3, 2023
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.

About PHP_CodeSniffer is a set of two PHP scripts; the main phpcs script that tokenizes PHP, JavaScript and CSS files to detect violations of a define

Squiz Labs 9.9k Jan 4, 2023
PHP Static Analysis Tool - discover bugs in your code without running it!

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even b

PHPStan 11.6k Dec 30, 2022
A PHP code-quality tool

GrumPHP Sick and tired of defending code quality over and over again? GrumPHP will do it for you! This composer plugin will register some git hooks in

PHPro 3.9k Jan 1, 2023
Beautiful and understandable static analysis tool for PHP

PhpMetrics PhpMetrics provides metrics about PHP project and classes, with beautiful and readable HTML report. Documentation | Twitter | Contributing

PhpMetrics 2.3k Dec 22, 2022
A tool for quickly measuring the size of a PHP project.

PHPLOC phploc is a tool for quickly measuring the size and analyzing the structure of a PHP project. Installation This tool is distributed as a PHP Ar

Sebastian Bergmann 2.3k Jan 4, 2023
Copy/Paste Detector (CPD) for PHP code.

PHP Copy/Paste Detector (PHPCPD) phpcpd is a Copy/Paste Detector (CPD) for PHP code. Installation This tool is distributed as a PHP Archive (PHAR): $

Sebastian Bergmann 2.2k Jan 1, 2023
:crystal_ball: Better Reflection is a reflection API that aims to improve and provide more features than PHP's built-in reflection API.

Better Reflection Better Reflection is a reflection API that aims to improve and provide more features than PHP's built-in reflection API. Why is it b

Roave, LLC 1.1k Dec 15, 2022
A command line refactoring tool for PHP

PHP Refactoring Browser Note: This software is under development and in alpha state. Refactorings do not contain all necessary pre-conditions and migh

QafooLabs 562 Dec 30, 2022