Code auditing, Technology

Exakat 2.1.7 Review

Posted on by dams

Exakat 2.1.7 reviewExakat 2.1.7 Review

Exakat 2.1.7 is out, with a treasure trove of new features : Exakat for Github Actions is available; PHP 8.0’s new attributes are supported; the typehint suggestion report includes functions, closures and arrow functions, and even more suggestions; new rules to prevent Global Namespace pollution and detect methods that should be defined in a parent class.

Here comes the Exakat 2.1.7 Review.

Exakat on Github actions

Exakat is now available with Github Actions. You can configure a Github action to run exakat directly in your workflow.

The installation process is actually one single operation : add the following file to your workflows folder : .github\workflows\test.yml:

on: [push, pull_request]
name: Test
jobs:
  exakat:
    name: Scan with Exakat
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Exakat
      uses: docker://exakat/exakat-ga

In brief, this instructs Github to start the Github Action on push and pull requests, to clone the code and run the docker image with exakat 2.1.7.

After execution, you’ll find results similar to the ones below, in your ‘Action’ tab :

Exakat on Github Actions results

 

Github Actions is free for public repositories.

We’ll publish an exhaustive tutorial on these new features soon. At the moment of writing, the submission to the Marketplace was sent, and it awaiting authorisation. The Exakat Github Action is already available though.

Typehints suggestion report for Closures and Arrow Functions

Exakat provides a report dedicated to typehint adoption : Typehints suggestion. This report collects missing typehint spots in the code (argument and property types, method return types), and provides suggestions to fill them.

New suggestions are added since version 2.1.6, so you may find new results and more choices in the type suggestion report. Upgrade Exakat, and run again.

This version of the Typehint report adds functions, closures and arrow functions. They are displayed at the beginning of the table, by type : functions, closures and arrow functions.

Typehints suggestions for functions, closures and arrow functions

 

Unlike methods, which have a natural identifier, based on their namespace, their class and their name, named and anonymous functions are identified differently : functions are identified with their name, closures and arrow functions are identified with their file and line number. The signature is also detailed in the table, which helps identify them uniquely. This ensures that they are easy to distinguish, while being possibly repeated across the code.

Typehints are important for all the functions. Closures or arrow map, which are used as callback functions, also benefit from using typehints. It will detect wrongly collected values, and help find the origin of sorting or filtering problems.

To produce this report, run the following command after an exakat audit :

php exakat.phar report -p <project name> -format Typesuggestion -v

The produced file will be available in the project folder, under the name ‘typehint.suggestion.html’;

More attributes PHP 8.0 support

Exakat 2.1.7 added support for most recent attribute syntax : #[Attributes]. Also, the multiple attributes in one is included.

<?php

#[A, B, C(3,3)]
function foo($a) {} 

?>

It is now time to start using those attributes and linking them in the code. We’ll add rules to check the availability of calls in the attributes.

In the mean time, what would you like to see checked in attributes? Do you have ideas to check the code, earlier than PHP which will wait for execution to do so? Drop us a note on twitter @exakat.

New analysis : don’t pollute global namespace

Following a stroke of inspiration from Cees-Jan Kiewiet, exakat 2.1.7 includes a new rule : ‘Don’t pollute namespace’. It reports functions, constants, classes, interfaces and traits that are defined in the global space.

The global space is the default namespace : \. This is where PHP native classes and functions live, and where we were creating classes before PHP 5.3.0, years ago.

Nowadays, it is recommended creating a namespace (or several) to store your creations, and reduce significantly naming conflicts : the namespace acts as a prefix for all classes and functions, so they are distinct one from another.

Don’t Pollute Global Space is part of the Analyze ruleset.

New analysis : Method could be in parent

This is a code architecture analysis. Imagine a parent class, with several children. This rule looks for methods which are defined in each of the children, but are not defined in the parent class.

<?php

class ParentClass {
    function foo() {}
}

class ChildClass1 extends Parent {
  function bar() {}
}

class ChildClass2 extends Parent {
  function bar() {}
}

class ChildClass3 extends Parent {
  function bar() {}
}

?>

In the example above, the ParentClass doesn’t have the barmethod, while each child has. This situation may have evolved on it own, and be totally coincidental. However, most of the time, this means the children’s classes are used in a similar fashion. In that case, it is recommended creating a bar method in the ParentClass, to ensure consistency between the children.

Next analysis : Method should not be in parent

This next rule is a prospective rule, and is currently being worked on. It would be the opposite of the previous rule. In that situation, the ParentClass and all the children class both have a barmethod.

But, in fact, the children have these methods because of the parent, and they make no use of them. Similarly to the previous rule, we’d like to recommend the suppression of the parent method, as it is not useful. The typical situation would look like this :

<?php

class ParentClass {
    // Just an example of actual code
  function bar() { doSomething(); }
}

class ChildClass1 extends Parent {
    // This class actually overwrite the parent method
  function bar() { doSomethingElse();}
}

class ChildClass2 extends Parent {
    // This class defines an empty method to skip it
  function bar() { }
}

class ChildClass3 extends Parent {
    // This class defines an empty method to skip it
  function bar() { }
}

?>

Two issues have to be sorted out here. The first is detecting the method cancellation. In the example above, it is an empty method, but other situation may arise, such are returning a constant value.

The second problem is the threshold of children that are actually making use of this method. Some of them might use it, but not all. An 80% of method cancellation would be a good start.

What do you think of this? Drop us a note on twitter @exakat if you have extra ideas on how to work on this challenge.

The Weekly Audits: 2020, Week #39

Exakat includes a ‘weekly’ report: this report is built with a selection of five analyses. This means a short audit report, with few issues to review. This is not a lot to read them, and review them in your code. Everyone in the PHP community can focus on one of the classic coding problems and fix it. Talk about the weekly audit around you: you’ll find programmers facing the same challenges.

To obtain the ‘weekly’ audit, run an audit, and request the ‘Weekly’ report.

# Init the project (skip when it is already done)    
php exakat.phar init -p <yourproject> -R https://github.com/Seldaek/monolog.git -git 

# Run the project (skip when it is already done)    
php exakat.phar project -p <yourproject> 

# Export the weekly project (every Monday)    
php exakat.phar report -p <yourproject> -format Weekly 

# Open projects/<yourproject>/weekly/index.html in your browser

Every week, you can find here 5 new analysis to review in your code. In fact, when your code is clean, you can also take a quick look at the upcoming analysis.

Weekly recommendations for PHP code review : 2020, week 2020-37

Weekly recommendations for PHP code review : 2020, week 2020-39

Happy PHP Code Reviews

The Exakat 2.1.7 review doesn’t cover the 405 analyzers are presented in the docs, including the noble : Foreach On Object: Foreach on object looks like a typo foreach($array as $object->property) {;

You can check all of the Exakat reports at the gallery: exakat gallery.

Download Exakat on exakat.io, install it with Docker, upgrade it with ‘exakat.phar upgrade -u’ and like us on github.