Re: [PHP-DEV] [Concept] Flip relative function lookup order (global, then local)

[John Coggeshall]

On Aug 21 2024, at 8:03 am, Rob Landers <rob@bottled.codes> wrote:
>
> If this is an attack vector for your application, then fully qualified names 
> is the way to go (WordPress does this nearly everywhere, for example).
This is an attack vector for every application and I would argue should be a 
real concern for the vast majority of applications out there -- any which rely 
on namespace-based frameworks and composer packages from untrustworthy sources. 
It's not just Wordpress -- literally every single PHP application that uses a 
publicly available framework and consumes external composer packages should be 
FQing their internal function calls. The natural behavior of the language 
shouldn't be the insecure way of doing things for the sake of maintaining BC 
compatibility with existing, insecure, code.
Cheers,
John