named argument not working

[Jobians]

Fatal error: Cannot use positional argument after named argument in /data/data/com.termux/files/home/php/bota/vendor/corveda/php-sandbox/src/PHPSandbox.php(6990) : eval()'d code on line 28

[peter279k]

Which PHP version you use?

Which PHP code snippets you execute via the PHPSandbox?

[Jobians]

1. Php8.2
2. $myClass->method(name: "John", age: 50);

[peter279k]

I think the fatal error is happened because it will execute the eval('$myClass->method(name: "John", age: 50);') code via the PHPSandbox.

I need to setup the PHPSandbox and verify above explanation.

[Jobians]

Ok I will be waiting thanks

[peter279k]

I think the fatal error is happened because it will execute the eval('$myClass->method(name: "John", age: 50);') code via the PHPSandbox.

I need to setup the PHPSandbox and verify above explanation.

The explanation is confirmed. And I use the following code snippets to get the same fatal error:

PHP Fatal error: Cannot use positional argument after named argument in /home/peterli/vendor/corveda/php-sandbox/src/PHPSandbox.php(6990) : eval()'d code on line 5

<?php

require_once __DIR__ . '/vendor/autoload.php';


class MyClass
{
    public function method($name, $age) {
        return [$name, $age];
    }
}
$class = new MyClass;

$codeSnippets = '<?php var_dump($class->method(name: \'Peter\', age: 50));';


$sandbox = new PHPSandbox\PHPSandbox;
$sandbox->defineVars(['class' => $class]);
$sandbox->whitelistClass(MyClass::class);
$sandbox->whitelistFunc('var_dump');
$sandbox->execute($codeSnippets);

To avoid getting the above fatal error you mention, I think the temporary way is to use the positional argument to call the method:

<?php

require_once __DIR__ . '/vendor/autoload.php';


class MyClass
{
    public function method($name, $age) {
        return [$name, $age];
    }
}
$class = new MyClass;

$codeSnippets = '<?php var_dump($class->method(\'Peter\', 50));';


$sandbox = new PHPSandbox\PHPSandbox;
$sandbox->defineVars(['class' => $class]);
$sandbox->whitelistClass(MyClass::class);
$sandbox->whitelistFunc('var_dump');
$sandbox->execute($codeSnippets);

[Jobians]

Ok thank you for your time, will you fix the issue in future?

[peter279k]

I think it's not easy to fix the issue because it has the compatibility issue.

It needs to use the named argument approach when calling the eval function. And the feature is only available for the PHP 8.0 version at least.

[Jobians]

@peter279k Hi

[peter279k]

@peter279k Hi

What's the matter?

[Jobians]

Can I use your package in production? Like can someone bypass it

[peter279k]

Sorry. I have no any forked/modified package about the Corveda/PHPSandbox.

Perhaps you can refer above comment I mention to fix this issue at this moment.

[Jobians]

So Corveda/PHPSandbox is safe to use in production

[peter279k]

I think it's safe to use in the production and it can help us to prevent executing unsafe codes.