Add more precise return types for the openssl cipher functions #4043

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

ondrejmirtes merged 1 commit into phpstan:2.1.x from stof:better_openssl_types

Sep 12, 2025

Merged

Add more precise return types for the openssl cipher functions #4043

ondrejmirtes merged 1 commit into phpstan:2.1.x from stof:better_openssl_types

Sep 12, 2025

Conversation

@stof

Copy link

Contributor

@stof stof commented Jun 4, 2025

Those functions return false (and trigger a warning) only when the argument is an unknown algorithm, which is not something worth checking when using them with a known algorithm.

I'm providing this improvement only on PHP 8+, because PHP 7 can have other kind of warnings (that have been upgraded to ValueError in PHP 8)

Replaces #3582

@stof stof force-pushed the better_openssl_types branch from 6144182 to ecfa6c2 Compare

June 4, 2025 11:40

staabm

staabm reviewed

Jun 4, 2025

View reviewed changes

src/Type/Php/OpensslCipherFunctionsReturnTypeExtension.php Outdated

Comment on lines 38 to 63

public function getTypeFromFunctionCall(FunctionReflection $functionReflection, FuncCall $functionCall, Scope $scope): Type

{

$returnType = ParametersAcceptorSelector::selectFromArgs(

$scope,

$functionCall->getArgs(),

$functionReflection->getVariants(),

)->getReturnType();

if (!$this->phpVersion->throwsValueErrorForInternalFunctions()) {

return $returnType;

}

if (count($functionCall->getArgs()) < 1) {

return $returnType;

}

$strings = $scope->getType($functionCall->getArgs()[0]->value)->getConstantStrings();

$results = array_unique(array_map(fn (ConstantStringType $algorithm): bool => $this->isSupportedAlgorithm($algorithm->getValue()), $strings));

if (count($results) === 1) {

return $results[0]

? TypeCombinator::remove($returnType, new ConstantBooleanType(false))

: new ConstantBooleanType(false);

}

return $returnType;

Copy link

Contributor

@staabm staabm Jun 4, 2025 •

edited

Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instead of

$returnType = ParametersAcceptorSelector::selectFromArgs(
			$scope,
			$functionCall->getArgs(),
			$functionReflection->getVariants(),
		)->getReturnType();

you can just return null; for the cases where the extension cannot provide a better type then the default.
that way you can simplify the extension a bit.

Copy link

Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I refactored the code to return null for all such cases.

staabm

staabm reviewed

Jun 4, 2025

View reviewed changes

src/Type/Php/OpensslCipherFunctionsReturnTypeExtension.php

return in_array(strtoupper($algorithm), $this->getSupportedAlgorithms(), true);

}

/** @return string[] */

Copy link

Contributor

@staabm staabm Jun 4, 2025 •

edited

Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

might work to use a more precise return type

Suggested change

/** @return string[] */

/** @return uppercase-string[] */

Copy link

Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I inspired from MbFunctionsReturnTypeExtensionTrait, which also uses simply string[]

@stof stof force-pushed the better_openssl_types branch from ecfa6c2 to bb6367d Compare

June 4, 2025 12:47

@staabm

Copy link

Contributor

staabm commented Jun 4, 2025

Needs cs fix

@stof stof force-pushed the better_openssl_types branch from bb6367d to 1e9efb6 Compare

June 5, 2025 08:32

@stof

Copy link

Contributor Author

stof commented Jun 5, 2025

@staabm done

ondrejmirtes

ondrejmirtes requested changes

Jul 17, 2025

View reviewed changes

conf/config.neon Outdated

tags:

- phpstan.dynamicFunctionThrowTypeExtension

Copy link

Member

@ondrejmirtes ondrejmirtes Jul 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please put this on 2.1.x and use AutowiredService attribute instead of changing config.neon. Thanks.

Copy link

Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ondrejmirtes sorry for the delay. This is now done.

@stof


 Add more precise return types for the openssl cipher functions

1c9db7a

@stof stof changed the base branch from 1.12.x to 2.1.x

September 12, 2025 10:53

@stof stof force-pushed the better_openssl_types branch from 1e9efb6 to 1c9db7a Compare

September 12, 2025 10:54

@ondrejmirtes ondrejmirtes merged commit 163d178 into phpstan:2.1.x

Sep 12, 2025

421 of 457 checks passed

@ondrejmirtes

Copy link

Member

ondrejmirtes commented Sep 12, 2025

Thank you.

@stof stof deleted the better_openssl_types branch

September 12, 2025 11:38

@stof stof mentioned this pull request

Sep 12, 2025

Add missing use statement for the AutowireService attribute #4324

Merged

@stof

Copy link

Contributor Author

@ondrejmirtes I discovered that in PHP <8.5, the openssl_get_cipher_methods function uses a different source of truth than the resolution of cipher algorithms in other functions, which means that some algorithms returned in this function are actually not supported in openssl_cipher_iv_length. See php/php-src#19994

Maybe this return type extension should be restricted to run only on PHP 8.5+ instead of PHP 8.0+. Or maybe it should perform actual filtering by attempting to read the iv length for PHP 8.0 to 8.4.

@ondrejmirtes

Copy link

Member

ondrejmirtes commented Oct 15, 2025

Please open an issue, this comment would get lost.

@stof stof mentioned this pull request

Oct 15, 2025

Openssl cipher method refinement is unsafe on PHP 8.4 and older due to a PHP bug phpstan/phpstan#13692

Open

Labels

None yet

3 participants

@stof @staabm @ondrejmirtes

Add more precise return types for the openssl cipher functions #4043

Add more precise return types for the openssl cipher functions #4043

Uh oh!

Conversation

@stof stof commented Jun 4, 2025

Uh oh!

@staabm staabm Jun 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

@stof stof Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

@staabm staabm Jun 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

@stof stof Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

staabm commented Jun 4, 2025

Uh oh!

stof commented Jun 5, 2025

Uh oh!

@ondrejmirtes ondrejmirtes Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

@stof stof Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ondrejmirtes commented Sep 12, 2025

Uh oh!

stof commented Oct 15, 2025

Uh oh!

ondrejmirtes commented Oct 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

@staabm staabm Jun 4, 2025 •

edited

Loading

@staabm staabm Jun 4, 2025 •

edited

Loading