Static, lightweight includes resolution for PHP

Abstract

Dynamic languages include a number of features that are challenging to model properly in static analysis tools. In PHP, one of these features is the include expression, where an arbitrary expression provides the path of the file to include at runtime. In this paper we present two complementary analyses for statically resolving PHP includes, one that works at the level of individual PHP files and one targeting PHP programs, possibly consisting of multiple scripts. To evaluate the effectiveness of these analyses we have applied the first to a corpus of 20 open-source systems, totaling more than 4.5 million lines of PHP, and the second to a number of programs from a subset of these systems. Our results show that, in many cases, includes can be either resolved to a specific file or a small subset of possible files, enabling better IDE features and more advanced program analysis tools for PHP.

Evolution of dynamic feature usage in PHP

“…We have already started to do so based on our earlier results, creating an analysis for resolving dynamic file inclusion expressions that is effective in many cases [18]. Similarly, we plan to investigate patterns of use for variable properties that can be leveraged to increase the precision of the type analysis we are currently building for PHP, and we are investigating dynamic techniques for better dealing with variable features and dynamic function invocations, especially those related to plugins.…”

Enabling PHP software engineering research in Rascal

“…The three file inclusion expressions show examples of dynamic behavior, such as calls to the dirname function, string concatenation, magic constants (e.g., __FILE__), and string splicing (where a variable is used directly inside a string, with or without curly braces). We created two analysis algorithms to statically compute which files could be included by each file inclusion expression [15]. One algorithm, FLRES, is used to quickly compute possible includes for a specific expression, while the other, PGRES, is a more precise algorithm that works given a script as an entry point into the site (i.e., a script that a user would navigate to on the web, instead of a script that is only ever included by other scripts) instead of looking at the script in isolation as is done by FLRES.…”

“…The program analysis algorithms are tuned for specific usage scenarios, so the FLRES dynamic file inclusion resolution algorithm [15], which is intended to be used in an IDE, generally runs in under 50 milliseconds (with some outliers taking longer), while PGRES, which is intended to resolve dynamic includes as part of a more powerful analysis [15], takes, on average, 21 seconds.…”

“…Built using the Rascal meta-programming language [10], a successor to Asf+Sdf [11] and RScript [12], PHP AiR has been, and is currently being, used in multiple research projects, including: empirical surveys of PHP language feature usage [13] and of the evolution of language feature usage over time [14]; a program analysis for resolving dynamic file includes [15]; a program analysis for resolving names used in reflective contexts in PHP code [16]; a refactoring from hand-coded SQL calls to uses of database libraries [17]; and multiple student projects to extract various metrics from PHP source code.…”

“…That paper focused mainly on uses of PHP AiR, spending very little time on the implementation, while this paper instead focuses on the implementation choices made and what can be learned from them. Several other papers [13][14][15][16] describe specific uses of PHP AiR, including empirical studies of how PHP is used and program analysis algorithms focused on specific dynamic language features. This paper is a longer version of an unpublished paper presented at the 4th International Workshop on Academic Software Development Tools and Techniques in 2013.…”