Including files with the "use" keyword

Question

I have a PHP 8.1 project and I use this line to include my header (it's not a class, just a regular php file).

 require_once 'include/cms-header.php';

Sonarlint gives a "major code smell php:S4833" on this" with the following explanation:

PHP 5.3 introduces namespaces to the language. Use of this mechanism should be preferred to include or include_once or require or require_once because it solves two common problems: it avoids name collisions it provides the ability to create alias which improve readability of the code Starting from its version 8, Drupal is relying on namespaces to be compliant with PSR-4 standard. Drupal’s modules should be compliant with PSR-4 standard and therefore should no longer rely on include or include_once or require or require_once functions. Noncompliant Code Example require_once('./modules/vegetable/src/Entity/Tomato.php'); Compliant Solution use Drupal\vegetable\Entity\Tomato Exceptions This rule doesn’t raise issues on autoload.php or ScriptHandler.php files.

I did some research, like these pages:

How does the keyword "use" work in PHP and can I import classes with it?

https://www.w3schools.com/php/keyword_use.asp

https://www.php.net/manual/en/language.namespaces.importing.php

I'm a junior developer and I don't really understand whether I should resolve this SonarLint suggestion and if I do, how I can resolve it. I don't have duplicate class names and it's my personal project, no contributions from other people.

Can you please advice what to do best? Thank you in advance.

Better get rid of that "Solarlint" stuff, it doesn't seem to provide any reliable info but rather a complete disinformation — Your Common Sense, Mar 14 '23 at 16:21
Thank you for confirming that this trigger is disinformation. — tampie, Mar 14 '23 at 16:30

score 0 · Answer 1 · answered Aug 30 '23 at 13:07

This time you should listen to LINT, because it's a security matter.

Problem

Using require and include functions may lead to file inclusion attacks

Import functions :

require
require_once
include
include_once

Noncompliant Code Example

require_once('./modules/Module/src/Entiry/User.php');

Compliant Solution

use Drupal\Module\Entity\User

Exceptions

autoload.php
ScriptHandler.php

References

MITRE CWE-97 1 - Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

OWASP Top 10 2017 Category A5 - Broken Access Control

I hope it helps you in your decision.

Including files with the "use" keyword

1 Answers1