-
-
Notifications
You must be signed in to change notification settings - Fork 88
Description
Describe the bug
The Generic.PHP.Syntax sniff is unable to check for syntax errors when the file content is passed via STDIN, resulting in a false negative.
To reproduce
Steps to reproduce the behavior:
- Run
echo '<?php $array = [1, 2, 3; // Missing closing bracket.' | phpcs --standard=Generic --sniffs=Generic.PHP.Syntax - - No errors are displayed.
Expected behavior
I believe the command above should display an error as there is a syntax error in the provided PHP code (missing closing bracket).
Additional information
This is happening because the sniff does not consider that $phpcsFile->getFilename() might return STDIN instead of a file name:
PHP_CodeSniffer/src/Standards/Generic/Sniffs/PHP/SyntaxSniff.php
Lines 59 to 60 in dd80edb
| $fileName = escapeshellarg($phpcsFile->getFilename()); | |
| $cmd = Common::escapeshellcmd($this->phpPath)." -l -d display_errors=1 -d error_prepend_string='' $fileName 2>&1"; |
When STDIN is passed to the php -l command, PHP returns an error saying that the file does not exist, and the sniff ends its execution without generating an error.
I think the sniff could be modified to run a different command when the file content is passed via STDIN (I'm not sure if this would work on Windows):
echo '<?php $array = [1, 2, 3; // Missing closing bracket.' | /usr/bin/php7.4 -l -d display_errors=1 -d error_prepend_string='' 2>&1
Versions (please complete the following information)
| Operating System | Linux |
| PHP version | 8.3 |
| PHP_CodeSniffer version | master |
| Standard | Generic |
| Install type | git clone |
Please confirm
- I have searched the issue list and am not opening a duplicate issue.
- I have read the Contribution Guidelines and this is not a support question.
- I confirm that this bug is a bug in PHP_CodeSniffer and not in one of the external standards.
- I have verified the issue still exists in the
masterbranch of PHP_CodeSniffer.