nikic / PHP-Parser / 28707584390

93%

push

github

Drop support for pipe operator in constant expression evaluator

Pipe operators are not actually supported in constant expressions.
Additionally, they depend on the environment (via available
functions etc), so even if they were supported in constant
expressions, they should be handled via the fallback so that it
has control over the environment.

Finally, this allows execution of arbitrary functions (including
things like `shell`) as part of the constant expression evaluator,
which may have security implications when using the constant
expression evaluator on untrusted code.

Thanks to Volker Dusch for the report.

1 of 1 new or added line in 1 file covered. (100.0%)

7723 of 8333 relevant lines covered (92.68%)

229.39 hits per line