ParseError: syntax error, unexpected 'empty' (T_EMPTY), expecting identifier (T_STRING)

Question

Hey i keep getting an syntax error in my code but i see absolutly nothing wrong, maybe a second set of eyes will help.

<?php

namespace SyzerPHP\Environment;
/**
 * Config.
 */
class Config extends Environment
{
    /**
     * validate().
     *
     * Validate the config array.
     *
     * @param array $conf The config array.
     *
     * @throws DomainException          If `$conf` argument is empty.
     * @throws DomainException          If `$conf` argument does not have a depth of 2.
     * @throws UnexpectedValueException If a section is not the start of an array.
     * @throws UnexpectedValueException If the section variable names are not capital letters.
     * @throws LengthException          If the section variable name and/or value is too long.
     *
     * @return void.
     */
    public static function validate(array $conf): void
    {
        if (\empty($conf)) {
            throw new Exception\DomainException('The config array is empty.');
        }
        if (\depth($conf) != 2) {
            throw new Exception\DomainException(\sprintf(
                'The config array does not have a depth of 2. Depth: `%s`.',
                (string) \depth($conf)
            ));
        }
        foreach ($conf as $var => $val) {
            if (!\is_array($val)) {
                throw new Exception\UnexpectedValueException(\sprintf(
                    'The section is not the start of an array. Passed: `%s`.',
                    \e($var)
                ));
            }
            foreach ($val as $var2 => $val2) {
                if (!\ctype_upper(\str_replace('_', '', $var2))) {
                    throw new Exception\UnexpectedValueException(\sprintf(
                        'The section variable name must all be caps. Passed: `%s`.',
                        \e($var2)
                    ));
                }
                if (\strlen($var2) > 30 || \strlen($val2) > 250) {
                    throw new Exception\LengthException(sprintf(
                        'The `$var2` and/or `$val2` variable is too long. Passed: `$var2` = `%s` `$val2` = `%s`.',
                        (string) \strlen($var2),
                        (string) \strlen($val2)
                    ));
                }
            }
        }
        self::clearConfig();
        self::$conf = $conf;
    }
}

The stack trace leads to this line if (\empty($conf)) {. I see no errors with the code. The php engine is expecting an identifier. As far as i am concerned i am missing no brackets, parenthesis, or any other symbol. The \ at the beginning of a function is to prevent substitution attacks. Also keep in mind this is php 7.2 syntax. If i missed an error please any help would be awesome. Thanks in advance.

`empty()` is a function, not part of a namespace. Same thing goes for a few others. — Funk Forty Niner, Jan 17 '18 at 20:19
Nowhere in the manual https://secure.php.net/manual/en/function.empty.php do they mention namespacing syntax. — Funk Forty Niner, Jan 17 '18 at 20:21
It should still work because as detailed here https://github.com/simcop2387/underhanded-crypto/blob/master/ScottArcizewski/email-exerpt.txt — Amplifier, Jan 17 '18 at 20:24
`empty` is more of an operator/language construct, not a function. That's why it can't be masked by namespacing. — mario, Jan 17 '18 at 20:29

score 3 · Answer 1 · answered Jan 17 '18 at 20:21

3

You should remove the backslash for:

empty
depth
is_array
ctype_upper
strlen
sprintf
str_replace
e

Basically, every function you are calling.

Those are PHP native functions. When using \something means you are trying to point to some namespace.

answered Jan 17 '18 at 20:21

Felippe Duarte

14,901
2
25
29

Then how is `\bin2hex(\random_bytes(10)` able to work? I am confused – Amplifier Jan 17 '18 at 20:27
forgot about this `\ ` ... `bin2hex(random_bytes(10))` is what you want. – Felippe Duarte Jan 17 '18 at 20:29
https://prntscr.com/i1vdo9 https://prntscr.com/i1vdof – Amplifier Jan 17 '18 at 20:32
That means now it works? – Felippe Duarte Jan 17 '18 at 20:33
I mean travis ci said nothing was wrong with it, that is why i am confused. – Amplifier Jan 17 '18 at 20:34
https://github.com/paragonie/constant_time_encoding/blob/master/src/Binary.php notice the use of it in this file. Tested code that works – Amplifier Jan 17 '18 at 20:36
Works from PHP > 7. Is travis CI and your machine with php > 7? – Felippe Duarte Jan 17 '18 at 20:39
It is supposed to prevent substitution attacks so other dependencies can not substitute the native php function with something else. All my other code works using this except this file. I am confused – Amplifier Jan 17 '18 at 20:39
My xampp apache server is running on php `7.2` and travis ci is testing my code on php `7.2`. Tested on both linux and windows – Amplifier Jan 17 '18 at 20:40
And what is the error message? – Felippe Duarte Jan 17 '18 at 20:42
No error if i do not use the config class above. When i do use it it says `ParseError: syntax error, unexpected 'empty' (T_EMPTY), expecting identifier (T_STRING)`. – Amplifier Jan 17 '18 at 20:44
My other classes work no problem usnig this method – Amplifier Jan 17 '18 at 20:44
This is another example that works https://www.hastebin.com/atagocufac.xml – Amplifier Jan 17 '18 at 20:46
For some reason, this doesn't work with `\empty`. Just remove for this function and see what happens. – Felippe Duarte Jan 17 '18 at 20:47
Ill try it out later i have work – Amplifier Jan 17 '18 at 20:50
Guess it only works on some functions – Amplifier Jan 17 '18 at 20:50
Ill create a work around to patch the security hole – Amplifier Jan 17 '18 at 20:51
And it still shows the error i do not use the `\`. – Amplifier Jan 18 '18 at 16:49

ParseError: syntax error, unexpected 'empty' (T_EMPTY), expecting identifier (T_STRING)

1 Answers1