md5() should be reported about phpstan-disallowed-calls HOT 4 CLOSED

Thanks. You can already disallow any function you want but maybe there should be a file with security-oriented deprecated calls, like md5, sha1, mysql_query etc.

from phpstan-disallowed-calls.

I see this package as an automatic guarantee that it will check all common errors for me. I manage hundreds of projects and I don't have the ability to manually configure what to control in each one.

What do these basic functions (as you write) control directly and, if necessary, allow the user to disable this control?

from phpstan-disallowed-calls.

This package is not designed to check all common errors for you, that would be an impossible task and there's no such guarantee.

The definition of "common error" varies project by project but if you want to check all projects for common errors (as defined by you as a maintainer) which are not checked (yet?) by this package, you can always create a config file and include it in all your projects just like you require this package. This is how the example .neon files in this repository were born 😀 and this is what I plan to do for a framework-specific calls in https://github.com/spaze/phpstan-disallowed-calls-nette

I think having an extra "deprecated" file (similar to the "dangerous" one) is a good idea but I'd say it's blocked by #62 in this particular case, just to manage expectations.

from phpstan-disallowed-calls.

The new bundled config file (disallowed-insecure-calls.neon) was released in 1.8.0

from phpstan-disallowed-calls.