zappzarapp-php-security/phpstan.neon at master · marcstraube/zappzarapp-php-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
includes:
    - vendor/ekino/phpstan-banned-code/extension.neon

parameters:
    level: 8
    paths:
        - src
        - tests

    # Security: Banned dangerous functions
    # Overrides defaults from ekino/phpstan-banned-code
    # See: https://github.com/ekino/phpstan-banned-code
    # Note: echo/exit are allowed (legitimate for HTML output and routing)
    banned_code:
        non_ignorable: false
        nodes:
            # eval() - code injection risk
            -
                type: Expr_Eval
                functions: null
            # Dangerous functions
            -
                type: Expr_FuncCall
                functions:
                    - dd
                    - debug_backtrace
                    - dump
                    - exec
                    - passthru
                    - phpinfo
                    - print_r
                    - proc_open
                    - shell_exec
                    - system
                    - var_dump

    # Performance
    parallel:
        jobSize: 20
        maximumNumberOfProcesses: 4

    # Type Coverage (false = don't warn about unused ignore patterns)
    reportUnmatchedIgnoredErrors: false

    # Exception Handling (strict checks for security package)
    # Requires @throws tags and explicit exception handling
    exceptions:
        check:
            missingCheckedExceptionInThrows: true
            tooWideThrowType: true
        checkedExceptionClasses:
            - Random\RandomException
        implicitThrows: false

    # Test assertions that PHPStan considers redundant but serve as documentation
    ignoreErrors:
        # assertIsArray/assertIsString on typed returns (valid test documentation)
        -
            message: '#will always evaluate to true#'
            identifier: method.alreadyNarrowedType
            path: tests/*
        # Tests use random_bytes() for generating test data - exception handling not needed
        -
            identifier: missingType.checkedException
            path: tests/*
        -
            identifier: throws.unusedType
            path: tests/*