vimeo/psalm

Preventing use of `false` as an array key

Open

#6,255 opened on Aug 7, 2021

View on GitHub
 (2 comments) (1 reaction) (0 assignees)PHP (668 forks)batch import
Help wantedbug

Repository metrics

Stars
 (5,369 stars)
PR merge metrics
 (Avg merge 3d 12h) (5 merged PRs in 30d)

Description

Discussed in https://github.com/vimeo/psalm/discussions/5965

Originally posted by M1ke June 21, 2021 https://psalm.dev/r/b5c9862354

In the given example we are wanting to search for an instance of a string in a list and unset it. However due to PHP's type coercion we accidentally unset the first element in our list instead because array_search returns false, and unsetting false coerces to 0.

As far as I see Psalm isn't flagging anything here.

I believe Psalm should be able to flag if a potential boolean value is used as an array key as some form of error - bool false is never an appropriate array-key - if somebody wishes to use potential false as an array key they should type cast it (e.g. 'false' would be a legitimate array key, as would 0)

In the class that handles array access, there is a code that will turn everything into integers in order to know what the code will do: https://github.com/vimeo/psalm/blob/19cc4cb4ee962a9872aa1e5c61ab41ef3c4348d5/src/Psalm/Internal/Analyzer/Statements/Expression/Fetch/ArrayFetchAnalyzer.php#L1167

We'd need to emit an issue in that method each time the offset is not expected (in this instance, false)

Contributor guide