From 430dfebade8b9132c6c8650a7b41044f6217c5e6 Mon Sep 17 00:00:00 2001
From: "John Paul E. Balandan, CPA" <paulbalandan@gmail.com>
Date: Sun, 22 Dec 2024 23:36:05 +0800
Subject: [PATCH] Implement `OpenSslEncryptParameterOutTypeExtension`

---
 conf/config.neon                              |  5 ++
 ...penSslEncryptParameterOutTypeExtension.php | 79 +++++++++++++++++++
 .../PHPStan/Analyser/nsrt/openssl-encrypt.php | 73 +++++++++++++++++
 3 files changed, 157 insertions(+)
 create mode 100644 src/Type/Php/OpenSslEncryptParameterOutTypeExtension.php
 create mode 100644 tests/PHPStan/Analyser/nsrt/openssl-encrypt.php

diff --git a/conf/config.neon b/conf/config.neon
index 19b6388858..0f4a3e959e 100644
--- a/conf/config.neon
+++ b/conf/config.neon
@@ -1569,6 +1569,11 @@ services:
 		tags:
 			- phpstan.dynamicFunctionThrowTypeExtension
 
+	-
+		class: PHPStan\Type\Php\OpenSslEncryptParameterOutTypeExtension
+		tags:
+			- phpstan.functionParameterOutTypeExtension
+
 	-
 		class: PHPStan\Type\Php\ParseStrParameterOutTypeExtension
 		tags:
diff --git a/src/Type/Php/OpenSslEncryptParameterOutTypeExtension.php b/src/Type/Php/OpenSslEncryptParameterOutTypeExtension.php
new file mode 100644
index 0000000000..bfdfc2b35e
--- /dev/null
+++ b/src/Type/Php/OpenSslEncryptParameterOutTypeExtension.php
@@ -0,0 +1,79 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Type\Php;
+
+use PhpParser\Node\Expr\FuncCall;
+use PHPStan\Analyser\Scope;
+use PHPStan\Reflection\FunctionReflection;
+use PHPStan\Reflection\ParameterReflection;
+use PHPStan\Type\Accessory\AccessoryNonEmptyStringType;
+use PHPStan\Type\FunctionParameterOutTypeExtension;
+use PHPStan\Type\NullType;
+use PHPStan\Type\StringType;
+use PHPStan\Type\Type;
+use PHPStan\Type\TypeCombinator;
+use PHPStan\Type\TypeTraverser;
+use PHPStan\Type\UnionType;
+use function in_array;
+use function openssl_get_cipher_methods;
+use function strtolower;
+use function substr;
+
+final class OpenSslEncryptParameterOutTypeExtension implements FunctionParameterOutTypeExtension
+{
+
+	public function isFunctionSupported(FunctionReflection $functionReflection, ParameterReflection $parameter): bool
+	{
+		return $functionReflection->getName() === 'openssl_encrypt' && $parameter->getName() === 'tag';
+	}
+
+	public function getParameterOutTypeFromFunctionCall(FunctionReflection $functionReflection, FuncCall $funcCall, ParameterReflection $parameter, Scope $scope): ?Type
+	{
+		$args = $funcCall->getArgs();
+		$cipherArg = $args[1] ?? null;
+
+		if ($cipherArg === null) {
+			return null;
+		}
+
+		$cipherType = $scope->getType($cipherArg->value);
+
+		return TypeTraverser::map($cipherType, static function (Type $type, callable $traverse): Type {
+			if ($type instanceof UnionType) {
+				return $traverse($type);
+			}
+
+			$tagTypes = [];
+
+			foreach ($type->getConstantStrings() as $cipherType) {
+				$cipher = strtolower($cipherType->getValue());
+				$mode = substr($cipher, -3);
+
+				if (!in_array($cipher, openssl_get_cipher_methods(), true)) {
+					$tagTypes[] = new NullType();
+					continue;
+				}
+
+				if (in_array($mode, ['gcm', 'ccm'], true)) {
+					$tagTypes[] = TypeCombinator::intersect(
+						new StringType(),
+						new AccessoryNonEmptyStringType(),
+					);
+					continue;
+				}
+
+				$tagTypes[] = new NullType();
+			}
+
+			if ($tagTypes === []) {
+				return TypeCombinator::addNull(TypeCombinator::intersect(
+					new StringType(),
+					new AccessoryNonEmptyStringType(),
+				));
+			}
+
+			return TypeCombinator::union(...$tagTypes);
+		});
+	}
+
+}
diff --git a/tests/PHPStan/Analyser/nsrt/openssl-encrypt.php b/tests/PHPStan/Analyser/nsrt/openssl-encrypt.php
new file mode 100644
index 0000000000..91e178514c
--- /dev/null
+++ b/tests/PHPStan/Analyser/nsrt/openssl-encrypt.php
@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace OpenSslEncrypt;
+
+use function PHPStan\Testing\assertType;
+
+class Foo
+{
+	public function testStringCipher(string $cipher): void
+	{
+		openssl_encrypt('data', $cipher, random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('non-empty-string|null', $tag);
+	}
+
+	public function testUnknownCipher(): void
+	{
+		openssl_encrypt('data', 'aes-256-cde', random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('null', $tag);
+
+		openssl_encrypt('data', 'abc-256-gcm', random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('null', $tag);
+
+		openssl_encrypt('data', 'abc-256-ccm', random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('null', $tag);
+	}
+
+	public function testAeadCipher(): void
+	{
+		$cipher = 'aes-256-gcm';
+		openssl_encrypt('data', $cipher, random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('non-empty-string', $tag);
+
+		$cipher = 'aes-256-ccm';
+		openssl_encrypt('data', $cipher, random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('non-empty-string', $tag);
+	}
+
+	public function testNonAeadCipher(): void
+	{
+		$cipher = 'aes-256-cbc';
+		openssl_encrypt('data', $cipher, random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('null', $tag);
+	}
+
+	/**
+	 * @param 'aes-256-ctr'|'aes-256-gcm' $cipher
+	 */
+	public function testMixedAeadAndNonAeadCiphers(string $cipher): void
+	{
+		openssl_encrypt('data', $cipher, random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('non-empty-string|null', $tag);
+	}
+
+	/**
+	 * @param 'aes-256-cbc'|'aes-256-ctr' $cipher
+	 */
+	public function testMixedTwoNonAeadCiphers(string $cipher): void
+	{
+		openssl_encrypt('data', $cipher, random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('null', $tag);
+	}
+
+	/**
+	 * @param 'aes-256-gcm'|'aes-256-ccm' $cipher
+	 */
+	public function testMixedTwoAeadCiphers(string $cipher): void
+	{
+		openssl_encrypt('data', $cipher, random_bytes(32), OPENSSL_RAW_DATA, random_bytes(16), $tag);
+		assertType('non-empty-string', $tag);
+	}
+}