ForbiddenCallTimePassByReferenceSniff::isCallTimePassByReferenceParam()

Complexity

Conditions	30
Paths	26

Size

Total Lines	108
Code Lines	60

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    protected function isCallTimePassByReferenceParam(\PHP_CodeSniffer_File $phpcsFile, $parameter, $nestingLevel)
    {
        $tokens   = $phpcsFile->getTokens();

        $searchStartToken = $parameter['start'] - 1;
        $searchEndToken   = $parameter['end'] + 1;
        $nextVariable     = $searchStartToken;
        do {
            $nextVariable = $phpcsFile->findNext(T_VARIABLE, ($nextVariable + 1), $searchEndToken);
            if ($nextVariable === false) {
                return false;
            }

            // Make sure the variable belongs directly to this function call
            // and is not inside a nested function call or array.
            if (isset($tokens[$nextVariable]['nested_parenthesis']) === false
                || (count($tokens[$nextVariable]['nested_parenthesis']) !== $nestingLevel)
            ) {
                continue;
            }


            // Checking this: $value = my_function(...[*]$arg...).

43% of this comment could be valid code. Did you maybe forget this after debugging?

            $tokenBefore = $phpcsFile->findPrevious(
                \PHP_CodeSniffer_Tokens::$emptyTokens,
                ($nextVariable - 1),
                $searchStartToken,
                true
            );

            if ($tokenBefore === false || $tokens[$tokenBefore]['code'] !== T_BITWISE_AND) {
                // Nothing before the token or no &.
                continue;
            }

            // Checking this: $value = my_function(...[*]&$arg...).

45% of this comment could be valid code. Did you maybe forget this after debugging?

            $tokenBefore = $phpcsFile->findPrevious(
                \PHP_CodeSniffer_Tokens::$emptyTokens,
                ($tokenBefore - 1),
                $searchStartToken,
                true
            );

            // We have to exclude all uses of T_BITWISE_AND that are not
            // references. We use a blacklist approach as we prefer false
            // positives to not identifying a pass-by-reference call at all.
            // The blacklist may not yet be complete.
            switch ($tokens[$tokenBefore]['code']) {
                // In these cases T_BITWISE_AND represents
                // the bitwise and operator.
                case T_LNUMBER:
                case T_VARIABLE:
                case T_CLOSE_SQUARE_BRACKET:
                case T_CLOSE_PARENTHESIS:
                    break;

                // Prevent false positive on assign by reference and compare with reference
                // with function call parameters.
                case T_EQUAL:
                case T_AND_EQUAL:
                case T_OR_EQUAL:
                case T_CONCAT_EQUAL:
                case T_DIV_EQUAL:
                case T_MINUS_EQUAL:
                case T_MOD_EQUAL:
                case T_MUL_EQUAL:
                case T_PLUS_EQUAL:
                case T_XOR_EQUAL:
                case T_SL_EQUAL:
                case T_SR_EQUAL:
                case T_IS_EQUAL:
                case T_IS_IDENTICAL:
                    break;

                // Unfortunately the tokenizer fails to recognize global constants,
                // class-constants and -attributes. Any of these are returned is
                // treated as T_STRING.
                // So we step back another token and check if it is a class
                // operator (-> or ::), which means we have a false positive.
                // Global constants still remain uncovered.
                case T_STRING:
                    $tokenBeforePlus = $phpcsFile->findPrevious(
                        \PHP_CodeSniffer_Tokens::$emptyTokens,
                        ($tokenBefore - 1),
                        $searchStartToken,
                        true
                    );
                    if ($tokens[$tokenBeforePlus]['code'] === T_DOUBLE_COLON
                        || $tokens[$tokenBeforePlus]['code'] === T_OBJECT_OPERATOR
                    ) {
                        break;
                    }
                    // If not a class constant: fall through.

                default:
                    // Deal with T_POW_EQUAL which doesn't exist in PHPCS 1.x.
                    if (defined('T_POW_EQUAL') && $tokens[$tokenBefore]['type'] === 'T_POW_EQUAL') {
                        break;
                    }

                    // The found T_BITWISE_AND represents a pass-by-reference.
                    return true;
            }
        } while ($nextVariable < $searchEndToken);

        // This code should never be reached, but here in case of weird bugs ;-)
        return false;
    }