PHPStan rule to forbid dynamic object instantiation

[cedric-anne]

Checklist before requesting a review

• I have read the CONTRIBUTING document.
• I have performed a self-review of my code.

Description

Instanciating new objects using a dynamic value can cause unexpected issues.

1. The value can be an invalid class name, for instance, a value stored in the DB can corresponds to an itemtype from a plugin that is not active anymore. Trying to instanciate this invalid class name would result in a fatal error.
2. In the past, we already had to security issues related to this, because it may permit to instanciate a class that is not a CommonDBTM class, and execute an unexpected code sequence (see 3b6bc1b).

I propose to add a PHPStan rule to detect and consider as errors these dynamic objects instantiations.

For the moment, the detected errors are not fixed. We could either try to fix them in this PR, or add them to the baseline and fix them later, or even use this rule to detect errors and fix them in separated PRs, and wait to be sure that there is no false positive issues before merging this PR.

Here is the test file I used to validate this rule:

<?php

// safe
$object = new class extends CommonDBTM {};

// safe
$class = null;
if (rand(0, 100) > 50) {
    $class = Computer::class;
} else {
    $class = Monitor::class;
}
$object = new $class();
unset($class);

// safe
$class = $_GET['itemtype'];
if ($class instanceof Computer) {
    $object = new $class();
}
unset($class);

// safe
$class = $_GET['itemtype'];
if (is_a($class, Computer::class, true)) {
    $object = new $class();
}
unset($class);

// safe
$class = $_GET['itemtype'];
if (is_subclass_of($class, Computer::class, true)) {
    $object = new $class();
}
unset($class);

// safe
$class = $_GET['itemtype'];
if (is_a($class, 'Computer', true)) {
    $object = new $class();
}
unset($class);

// safe, unless PHPDoc ignored
/** @var Computer $class */
$class = $_GET['itemtype'];
$object = new $class();
unset($class);

// safe, unless PHPDoc ignored
/** @var class-string<CommonDBTM>|Computer $class */
$class = $_GET['itemtype'];
$object = new $class();
unset($class);

// safe, unless PHPDoc ignored
/** @var Computer&\Symfony\Component\String\Inflector\InflectorInterface $class */
$class = $_GET['itemtype'];
$object = new $class();
unset($class);

// unsafe
$class = null;
if (rand(0, 100) > 50) {
    $class = Computer::class;
} else {
    $class = $_GET["itemtype"];
}
$object = new $class();
unset($class);

// unsafe
/** @var class-string<CommonDBTM>|class-string $class */
$class = $_GET['itemtype'];
$object = new $class();
unset($class);

and the corresponding results:

 ------ ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ 
  Line   test.php                                                                                                                                                                
 ------ ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ 
  47     Instantiating an object from an unrestricted dynamic string is forbidden. To safely instantiate a `CommonDBTM` object, please use the `getItemForItemtype()` function,  
         otherwise, you have to limit the possible values.                                                                                                                       
         🪪 glpi.forbidDynamicInstantiation                                                                                                                                      
  53     Instantiating an object from an unrestricted dynamic string is forbidden. To safely instantiate a `CommonDBTM` object, please use the `getItemForItemtype()` function,  
         otherwise, you have to limit the possible values.                                                                                                                       
         🪪 glpi.forbidDynamicInstantiation                                                                                                                                      
  59     Instantiating an object from an unrestricted dynamic string is forbidden. To safely instantiate a `CommonDBTM` object, please use the `getItemForItemtype()` function,  
         otherwise, you have to limit the possible values.                                                                                                                       
         🪪 glpi.forbidDynamicInstantiation                                                                                                                                      
  69     Instantiating an object from an unrestricted dynamic string is forbidden. To safely instantiate a `CommonDBTM` object, please use the `getItemForItemtype()` function,  
         otherwise, you have to limit the possible values.                                                                                                                       
         🪪 glpi.forbidDynamicInstantiation                                                                                                                                      
  75     Instantiating an object from an unrestricted dynamic string is forbidden. To safely instantiate a `CommonDBTM` object, please use the `getItemForItemtype()` function,  
         otherwise, you have to limit the possible values.                                                                                                                       
         🪪 glpi.forbidDynamicInstantiation                                                                                                                                      
 ------ ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ 

[cedric-anne]

Replaced by #20104.