go get -v github.com/quasilyte/phpgrep/cmd/phpgrep github.com/quasilyte/phpgrep (download) github.com/z7zmey/php-parser (download) github.com/quasilyte/phpgrep

github.com/quasilyte/phpgrep

go/src/github.com/quasilyte/phpgrep/utils.go:180:37: cannot use bytes.NewReader(code) (type *bytes.Reader) as type []byte in argument to php7.NewParser

Define -format argument that accepts a string that describes how match results should be printed. If it's an empty string, the entire match is printed as is (current behavior). For non-empty patterns every match is formatted accordingly.

Example:

phpgrep -format '$s' srcdir 'die("s:str")'

pattern: 'die("s:str")'
format: '$s'

input: die("hello")
output without format: die("hello")
output with format: "hello"

I can't seem to install your tool

➜ go get -v github.com/quasilyte/phpgrep/cmd/phpgrep
github.com/z7zmey/php-parser/walker
github.com/z7zmey/php-parser/position
github.com/cznic/golex/lex
github.com/z7zmey/php-parser/errors
github.com/z7zmey/php-parser/freefloating
github.com/z7zmey/php-parser/node
github.com/z7zmey/php-parser/scanner
github.com/z7zmey/php-parser/node/name
github.com/z7zmey/php-parser/node/expr/cast
github.com/z7zmey/php-parser/node/scalar
github.com/z7zmey/php-parser/node/expr/assign
github.com/z7zmey/php-parser/node/expr/binary
github.com/z7zmey/php-parser/node/expr
github.com/z7zmey/php-parser/node/stmt
github.com/z7zmey/php-parser/printer
github.com/z7zmey/php-parser/parser
github.com/z7zmey/php-parser/php7
github.com/quasilyte/phpgrep
# github.com/quasilyte/phpgrep
../go/src/github.com/quasilyte/phpgrep/matcher.go:432:8: undefined: expr.ParenExpr
../go/src/github.com/quasilyte/phpgrep/utils.go:122:4: undefined: expr.ParenExpr
➜

$ cat test.php
<?php
var_dump([]);
var_dump([1]);
var_dump([1, 2]);
var_dump([1,]);
var_dump([1,2,]);
$ phpgrep ./test.php '[${"*"}, $_]'
./test/php:4: [1]
found 1 matches

Expected 2 matches.

All cases below where the pattern doesn't match when it should are a result of no backtracking support inside the matcher.

The ${"*"} node stops when no more nodes are left inside the block or when the next pattern node can be matched instead. If we fail a match after that, we never try to continue from the last ${"*"} to see if we can stop at a different point and accept the match.

Backtracking would make matching slower, but some (how many?) cases where we need it can be determined during the pattern compile time. For the block that doesn't require it we can generate a non-backtracking node kind.

Some examples that yield the unexpected results:

<?php

f(${"*"}, $_)
// matches f(1)
// doesn't match f(1, 2)
// doesn't match f(1, 2, 3)
//
// Potential solution: generate "ends-with" pattern for this case,
// check that the last node matches, ignore everything before it.

f(${"*"}, 1, 1, ${"*"})
// matches f(1, 1, 1)
// doesn't match f(1, 1)
// doesn't match f(0, 1, 0, 1, 1, 0)
//
// Either implement backtracking or reject such patterns during the compile time.

global ${"*"}, $x, $x
// matches global $a, $a
// doesn't match global $a, $b, $b

| Class | Description | |---|---| | * | Any node, 0-N times | | + | Any node, 1-N times | | int | Integer literal | | float | Float literal | | num | Integer or float literal | | str | String literal | | var | Variable |

If --progress is set to "update", don't print the errors right away, wait until we parse all files.

This helps to avoid the cluttered output.

If case sensitivity should be strict, -case-sensitive flag can be used to match spellings literally.

Note that case insensitive mode only applies to things that are insensitive in PHP as well: function and class names, etc.

Suppose we have this PHP code (test.php):

a::f()
a::F()

New phpgrep behavior:

$ phpgrep test.php 'a::f()'
finds both a::F() and a::f()

$ phpgrep -case-sensitive test.php 'a::f()'
finds only a::f()

Refs #57

Signed-off-by: Iskander Sharipov [email protected]

At some point we updated php-parser. A side effect of that is that there is no need to subtract 1 from the start pos to get the [begin,end] slice. We did subtract 1 and as a result text that was forwarded to the filters always had 1 extra byte from the beginning.

This commit also adds a way to test a phpgrep binary (e2e test).

Updates #5

Signed-off-by: Iskander Sharipov [email protected]

getting error "use of internal package github.com/quasilyte/phpgrep/internal/phpgrep not allowed"

Readme says phpgrep can be used as command as well as library but its not, please help us getting the right way or there is any fix required ?

Hi,

Hope you are all well !

I wanted to use phpgrep to check if my prestashop code is missing some escaping function for any sql statement.

For eg, in this commit https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8, you can see that the pSQL and (int) functions are missing.

Is it possible to grep a list of all "Db::getInstance()" and check if the variables are escaped or cast ?

Thanks for any insights or inputs on that :-)

Cheers, Luc Michalski

Is that possible to get whole body of function as a string when you find specific function in this function?

Example:

function(){
    $var = "not important";
    notme();
}

function2(){
    $var = "important";
    imhere();
}

Command: phpgrep find only imhere();

Output:

    $var = "important";
    imhere();