You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SonarCloud fails the phalcon quality gate on v6.0.x. It reports a vulnerability (phpsecurity:S6173, reflection injection) in HtmlRenderer::getVarDump(). This is a false positive: the ReflectionMethod call runs only for objects, and request data cannot be an object.
There is also a difference between the two projects. When an argument array holds a closed resource, getArrayDump() prints resource (closed) in phalcon and Resource id #N in cphalcon.
Changes (phalcon and cphalcon):
Move the object branch of getVarDump() into a new private method, dumpObject(object $variable).
Move the dump() method check into a new private method, canCallDump(object $variable).
phalcon only: a closed resource in getArrayDump() now prints Resource id #N, the same as cphalcon.
Add a test for a closed resource in HtmlRendererTest::testVarDumpAndArrayDumpBranches. The test file is now the same in both projects.
Activity
niden commentedon Nov 7, 2026
Resolved in #17744