Skip to content

[BUG]: Debug HtmlRenderer: fix SonarCloud reflection warning and closed-resource output #17743

Closed

Description

@niden

SonarCloud fails the phalcon quality gate on v6.0.x. It reports a vulnerability (phpsecurity:S6173, reflection injection) in HtmlRenderer::getVarDump(). This is a false positive: the ReflectionMethod call runs only for objects, and request data cannot be an object.

There is also a difference between the two projects. When an argument array holds a closed resource, getArrayDump() prints resource (closed) in phalcon and Resource id #N in cphalcon.

Changes (phalcon and cphalcon):

  • Move the object branch of getVarDump() into a new private method, dumpObject(object $variable).
  • Move the dump() method check into a new private method, canCallDump(object $variable).
  • phalcon only: a closed resource in getArrayDump() now prints Resource id #N, the same as cphalcon.
  • Add a test for a closed resource in HtmlRendererTest::testVarDumpAndArrayDumpBranches. The test file is now the same in both projects.

Activity

  1. self-assigned this
    on Nov 7, 2026
  2. added theissue type on Nov 7, 2026
  3. added
    bugA bug report
    5.0The issues we want to solve in the 5.0 release
    on Nov 7, 2026
  4. moved this to Active Sprint in Phalcon v5on Nov 7, 2026
  5. niden commented on Nov 7, 2026

    @niden
    SponsorMemberAuthor

    Resolved in #17744

  6. moved this from Active Sprint to Implemented in Phalcon v5on Nov 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

5.0The issues we want to solve in the 5.0 releasebugA bug reportstatus: mediumMedium

Type

Projects

  • Status
    Implemented

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions