On Aug 21 2024, at 8:03 am, Rob Landers <[email protected]> wrote:
>
> If this is an attack vector for your application, then fully qualified names is the way to go
> (WordPress does this nearly everywhere, for example).
This is an attack vector for every application and I would argue should be a real concern for the
vast majority of applications out there -- any which rely on namespace-based frameworks and composer
packages from untrustworthy sources. It's not just Wordpress -- literally every single PHP
application that uses a publicly available framework and consumes external composer packages should
be FQing their internal function calls. The natural behavior of the language shouldn't be the
insecure way of doing things for the sake of maintaining BC compatibility with existing, insecure,
code.
Cheers,
John