• Stars
    star
    169
  • Rank 217,749 (Top 5 %)
  • Language
    PHP
  • License
    MIT License
  • Created almost 9 years ago
  • Updated over 8 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A static analysis engine

Build Status

A static analysis engine...

Usage:

bin/tuli analyze file1 file2 path

Installation

Install it as a composer dependency!!!

$ composer require ircmaxell/tuli dev-master

Then simply execute vendor/bin/tuli as normal

Or check it out into its own project. Then composer install the dependencies:

$ composer install

Then simply bin/tuli to execute.

Example:

code.php:

<?php

$a = 1.0;
$b = 2;

$c = foo($a, $b);

$d = foo($b, $c);

function foo(int $a, int $b): int {
    if ($a > $b) {
        return $a + $b + 0.5;
    }
}

Then, in shell:

$ bin/tuli analyze code.php
Analyzing code.php
Determining Variable Types
Round 1 (15 unresolved variables out of 20)
.
Detecting Type Conversion Issues
Type mismatch on foo() argument 0, found float expecting int code.php:6
Type mismatch on foo() return value, found float expecting int code.php:12
Default return found for non-null type int code.php:10
Done

The three errors it found are:

  • Type mismatch on foo() argument 0, found float expecting int code.php:6

    Meaning that at code.php on line 6, you're passing a float to the first argument when it declared an integer

  • Type mismatch on foo() return value, found float expecting int code.php:12

    The value that's being returned on line 12 is a float, but it was declared as an integer in the function signature.

  • Default return found for non-null type int code.php:10

    There's a default return statement (not supplied) for a typed function

That's it!

Currently Supported Rules:

  • Function Argument Types

    It will check all typed function arguments and determine if all calls to that function match the type.

  • Function Return Types

    If the function's return value is typed, it will determine if the function actually returns that type.

  • Method Argument Types

    It will check all calls to a method for every valid typehint permutation to determine if there's a possible mismatch.

Todo:

  • A lot

Another example:

<?php

class A {
    public function foo(int $a) : int {
        return $a;
    }
}

class B extends A {
    public function foo(float $a) : float {
        return $a;
    }
}

class C extends B {
    public function foo(int $a) : int {
        return $a;
    }
}

function foo(A $a) : int {
    return $a->foo(1.0);
}

Running:

$ bin/tuli analyze code.php
Analyzing code.php

Determining Variable Types
Round 1 (5 unresolved variables out of 7)

Round 2 (3 unresolved variables out of 7)

Detecting Type Conversion Issues
Detecting Function Argument Errors
Detecting Function Return Errors
Type mismatch on foo() return value, found float expecting int code.php:22
Detecting Method Argument Errors
Type mismatch on A->foo() argument 0, found float expecting int code.php:22
Type mismatch on C->foo() argument 0, found float expecting int code.php:22
Done

Again, it found 3 errors:

  • Type mismatch on foo() return value, found float expecting int code.php:22

    It looked at all possible A::foo() method definitions (A::foo, B::foo, C::foo), and it detmermined that the general return type is float (since type widening allows int to be passed to float, but not the other way around). Therefore, returning ->foo() directly can result in a type error.

  • Type mismatch on A->foo() argument 0, found float expecting int code.php:22

  • Type mismatch on C->foo() argument 0, found float expecting int code.php:22

    We know that if you use type A or C, you're trying to pass a float to something that declares an integer.

More Repositories

1

password_compat

Compatibility with the password_* functions that ship with PHP 5.5
PHP
2,149
star
2

RandomLib

A library for generating random numbers and strings
PHP
841
star
3

PHPPHP

A PHP VM implementation in PHP
PHP
812
star
4

php-compiler

A compiler. For PHP
PHP
793
star
5

PhpGenerics

Here be dragons
PHP
498
star
6

filterus

A simple filtering library for PHP
PHP
455
star
7

PHP-PasswordLib

A library for generating and validating passwords
PHP
373
star
8

monad-php

A simple Monad library for PHP
PHP
296
star
9

php-cfg

A Control Flow Graph implementation in PHP
PHP
242
star
10

PHP-Yacc

A PHP port of kmyacc
PHP
150
star
11

phpvm

A PHP version manager for CLI PHP
PHP
150
star
12

PHP-CryptLib

A Cryptography Library for PHP
PHP
144
star
13

FFIMe

A FFI Wrapper library and header parser!
PHP
136
star
14

SecurityLib

SecurityLib
PHP
126
star
15

Stauros

A fast XSS sanitization library for PHP
PHP
119
star
16

php-security-scanner

A static security scanner for PHP
PHP
97
star
17

Tari-PHP

A middleware proposal for PHP
PHP
78
star
18

password-policy

A password policy enforcer for PHP and JavaScript
PHP
77
star
19

php-ast-visualizer

An AST visualizer, for PHP
PHP
75
star
20

prerano

A new language for PHP
PHP
65
star
21

php-preprocessor

A PreProcessing library for PHP
PHP
49
star
22

ErrorExceptions

A library for converting core PHP errors into ErrorExceptions
PHP
43
star
23

PHP-BrainFuck

A brainfuck interpreter for PHP
PHP
42
star
24

random_compat

Compatibility library for proposed simplified random number generator
PHP
41
star
25

php-c-parser

A C parser built in and for PHP (yes, it's a bad idea)...
PHP
40
star
26

php-llvm

A "lightweight" wrapper around LLVM-C in native PHP
PHP
39
star
27

php-types

A PHP Type reconstruction library
PHP
36
star
28

php-compiler-toolkit

A compiler toolkit. For PHP (yes, I am creative at naming things)...
PHP
30
star
29

resume

Anthony Ferrara's Resume (CV)
30
star
30

php-math-parser

A Shunting-Yard Based Math Engine For PHP
PHP
29
star
31

Protocol-Lib

A library for runtime checking of protocols
PHP
27
star
32

php-optimizer

A CFG Optimizer for PHP
PHP
24
star
33

RequirePHP

A RequireJS clone in PHP - As a dependency Loader
PHP
22
star
34

ballandchain

A PHP implementation of BallAndChain
PHP
20
star
35

libgccffi

libgccffi interface for PHP, based on 7.4's FFI and FFIMe
PHP
19
star
36

MixinPHP

A test mixin library for super-happy-crazy-time
PHP
18
star
37

php-ndata

NData PECL extension for dealing with native data types
C
15
star
38

cpu_assembler

An assembler for my custom CPU
PHP
13
star
39

TrueObjectStore

What SPLObjectStorage Should Have Been
PHP
13
star
40

haas

Hugs, As A Service
HTML
13
star
41

programming-with-anthony

Scripts for the Programming With Anthony series on YouTube
11
star
42

php-object-symbolresolver

A linux object file (ELF) parser
PHP
10
star
43

password-bad-web-app

A bad web app, to demonstrate password hashing issues DO NOT USE!!!
PHP
10
star
44

quality-checker

PHP Quality Checker
PHP
10
star
45

blog.ircmaxell.com

blog.ircmaxell.com future site
Less
9
star
46

Primitives

A collection of primitive types for PHP
PHP
6
star
47

blog-ideas

6
star
48

cryptography-presentation-tnphp

Slides for the Cryptography Presentation done at TrueNorthPHP on Nov 2, 2012
JavaScript
6
star
49

Ircmaxell.com

PHP
5
star
50

ZPP

A PHP implementation of Zend-Parse-Parameters
PHP
5
star
51

XssBadWebApp

A Intentionally Vulnerable Bad Web Application With XSS Vulnerabilities - *DO NOT USE!!!*
PHP
5
star
52

CodeReviewSecurityRepo

Code Review for Security Repository Of Code To Review
PHP
5
star
53

password-advice

The website behind password-advice.com
4
star
54

SetLib

A Badly Named Playground
PHP
4
star
55

DontBeStupid-Presentation

A repo of the Don't Be Stupid, Grasp Solid presentation at NYPHP on 5-22-12
JavaScript
3
star
56

hashguesser

Hash guesser
JavaScript
3
star
57

jQuery.OOP

A pseudo-port of MooTools OOP to jQuery
2
star
58

Intervalometer

An intervalometer
Arduino
2
star
59

BehaviorTest

A Proof-Of-Concept behavioral testing app
PHP
2
star
60

password-hashing-mini-presentation

Password-Hashing-Mini-Presentation
JavaScript
2
star
61

PHPTest

A Unit Testing Framework for PHP
PHP
2
star
62

ITL

Some silly test programming language thingy
Ruby
1
star
63

solid-presentation-tnphp

Slides for the SOLID OO Design presentation at True North PHP on Nov 3, 2012
JavaScript
1
star
64

PreProcessor

A trivial attempt at a PHP preprocessor (DO NOT USE!!! Experimental ONLY!!!)
PHP
1
star
65

jsGoodies

Just some JS snipits I've found useful
JavaScript
1
star
66

8bit-cpu-v2

Ruby
1
star