Skip to content

Commit a38facd

Browse files
committed
Remove DeclaredHandler to prevent accidental internal discovery
The `DeclaredHandler` has become a liability. Because class, interface, and enum names are represented as strings, we run the risk of the library "helpfully" identifying a piece of user input as an internal system part. If a user happens to input a string that matches an internal class or enum name, the stringifier would automatically confirm its existence by applying the specialized formatting. This creates an information leakage vulnerability where an outsider could map out our application's internal architecture simply by guessing names. By removing this handler, we ensure that a string is treated just as a string. This follows our recent "secure-by-default" trend seen in the `CallableStringifier` changes: we are prioritizing the privacy of the application's internal blueprint over the convenience of automatic type detection.
1 parent c082c6f commit a38facd

File tree

5 files changed

+0
-134
lines changed

5 files changed

+0
-134
lines changed

README.md

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -83,12 +83,6 @@ echo stringify(['foo' => true, 'bar' => 42, 'baz' => ['qux' => INF, 'quux' => nu
8383
echo stringify(tmpfile()) . PHP_EOL;
8484
// `resource <stream>`
8585

86-
echo stringify(BasicEnumeration::FOO) . PHP_EOL;
87-
// `BasicEnumeration::FOO`
88-
89-
echo stringify(BackedEnumeration::QUX) . PHP_EOL;
90-
// `BackedEnumeration::QUX`
91-
9286
echo stringify(new WithProperties()) . PHP_EOL;
9387
// `WithProperties { +$publicProperty=true #$protectedProperty=42 -$privateProperty="something" }`
9488

@@ -136,9 +130,6 @@ echo stringify(new RuntimeException()) . PHP_EOL;
136130

137131
echo stringify(new InvalidArgumentException('This is the exception message')) . PHP_EOL;
138132
// `InvalidArgumentException { "This is the exception message" in file.php:112 }`
139-
140-
echo stringify(Traversable::class) . PHP_EOL;
141-
// `Traversable`
142133
```
143134

144135
To see more examples of how to use the library check the [integration tests](tests/integration).

src/Handlers/CompositeHandler.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ public static function create(): self
4141
new ResourceHandler($quoter),
4242
new BoolHandler($quoter),
4343
new NullHandler($quoter),
44-
new DeclaredHandler($quoter),
4544
$jsonEncodableHandler = new JsonEncodableHandler(),
4645
);
4746
$handler->prependHandler(

src/Handlers/DeclaredHandler.php

Lines changed: 0 additions & 42 deletions
This file was deleted.

tests/integration/stringify-declared.phpt

Lines changed: 0 additions & 21 deletions
This file was deleted.

tests/unit/Handlers/DeclaredHandlerTest.php

Lines changed: 0 additions & 61 deletions
This file was deleted.

0 commit comments

Comments
 (0)