Skip to content

Conversation

@nickvergessen
Copy link
Member

As discussed in #36928 (comment)

Looking at the diff, I'm not sure it's worth it.

Checklist

@ChristophWurst
Copy link
Member

I'm on the fence here. It's a small enhancement in all fairness.

} else {
$reflectionMethod = new ReflectionMethod($controller, $methodName);
$attributes = $reflectionMethod->getAttributes(BruteForceProtection::class);
$attributes = $this->reflector->getAttributes(BruteForceProtection::class);

Check failure

Code scanning / Psalm

InvalidArgument

Argument 1 of OC\AppFramework\Utility\ControllerMethodReflector::getAttributes expects class-string<Attribute>, but OCP\AppFramework\Http\Attribute\BruteForceProtection::class provided
} else {
$reflectionMethod = new ReflectionMethod($controller, $methodName);
$attributes = $reflectionMethod->getAttributes(BruteForceProtection::class);
$attributes = $this->reflector->getAttributes(BruteForceProtection::class);

Check failure

Code scanning / Psalm

InvalidArgument

Argument 1 of OC\AppFramework\Utility\ControllerMethodReflector::getAttributes expects class-string<Attribute>, but OCP\AppFramework\Http\Attribute\BruteForceProtection::class provided

$reflectionMethod = new ReflectionMethod($controller, $methodName);
$hasAttribute = !empty($reflectionMethod->getAttributes(UseSession::class));
$hasAttribute = !empty($this->reflector->getAttributes(UseSession::class));

Check failure

Code scanning / Psalm

InvalidArgument

Argument 1 of OC\AppFramework\Utility\ControllerMethodReflector::getAttributes expects class-string<Attribute>, but OCP\AppFramework\Http\Attribute\UseSession::class provided

$reflectionMethod = new ReflectionMethod($controller, $methodName);
$hasAttribute = !empty($reflectionMethod->getAttributes(UseSession::class));
$hasAttribute = !empty($this->reflector->getAttributes(UseSession::class));

Check failure

Code scanning / Psalm

InvalidArgument

Argument 1 of OC\AppFramework\Utility\ControllerMethodReflector::getAttributes expects class-string<Attribute>, but OCP\AppFramework\Http\Attribute\UseSession::class provided
*/
class ControllerMethodReflector implements IControllerMethodReflector {

protected ?\ReflectionMethod $reflection;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be more specific because exist other types of reflections:

Suggested change
protected ?\ReflectionMethod $reflection;
protected ?\ReflectionMethod $reflectionMethod;

Copy link
Contributor

@come-nc come-nc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 I like it

}

/**
* @template T of Attribute
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Attribute classes do not extend Attribute class, which is final. So you cannot do that.

@ChristophWurst
Copy link
Member

Subjectively what I don't like about the controller method reflector is that is so stateful. There are two methods to work with it. One analyzes a controller method, another one allows you to test for specific attributes. It sounds a bit artificial but there is no guarantee that at the point of asking for an attribute, nobody else called the reflect method.

In that sense, and with the way PHP reflection works anyway, I would prefer to make the service stateless and pass the controller object and method name into hasAttribute. It ensures that the result you get is only based on what you pass it, not what someone called before.

This remark is not new with attributes. The problem was there with annotations as well. It is just that parsing phpdoc annotations is expensive and there the state for caching makes sense for better performance.

@nickvergessen
Copy link
Member Author

Exactly my thoughts after seeing the resulting PR.
So also tend to close it now and continue as before

@nickvergessen nickvergessen marked this pull request as draft March 20, 2023 11:08
@nickvergessen nickvergessen deleted the techdebt/noid/bruteforce-protection-attribute branch April 14, 2023 11:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants