Skip to content

Conversation

@TimWolla
Copy link
Contributor

@TimWolla TimWolla commented May 8, 2024

The mbstring.func_overload misfeature no longer exists in PHP 8.x which is now the minimally supported version. Thus we can directly use strlen() and substr() and avoid the indirection through the Binary class, improving performance.

@paragonie-security
Copy link
Contributor

The Binary class is used in a lot of other software that depends on this library.

@TimWolla
Copy link
Contributor Author

The Binary class is used in a lot of other software that depends on this library.

That's why I did not remove it and just marked it as Deprecated.

@paragonie-security
Copy link
Contributor

It's not deprecated, either. Too many things use it, and marking it as deprecated will cause downstream issues with e.g. Psalm.

@TimWolla
Copy link
Contributor Author

Okay. Are you requesting me to drop the Deprecation commit? Shall I make any other changes to this PR or are the first two commits good?

@TimWolla
Copy link
Contributor Author

@paragonie-security Friendly ping regarding my question above. I'm happy to make the necessary changes to the PR, but would need to know what changes I should make.

@paragonie-security
Copy link
Contributor

There are many downstream projects that depend on the Binary class and they do not include conditional logic for PHP or library versions. The reason they depend on this logic is that they're guaranteed to get an unsurprising result.

Marking it as deprecated is harmful because those libraries, which may have wide PHP supported bases, will start getting deprecation warnings on PHP 8 and then scramble to update their code in less secure ways.

See facebookarchive/php-graph-sdk#552 (comment) for why this code existed in the first place. If we ever deprecate this, it must only occur after the entire PHP ecosystem has abandoned PHP < 8.0. There are still stragglers, so we cannot do that today.

The `mbstring.func_overload` misfeature no longer exists in PHP 8.x which is
now the minimally supported version. Thus we can directly use `strlen()` and
`substr()` and avoid the indirection through the `Binary` class, improving
performance.
`mbstring.func_overload` is no more, thus this can be a direct wrapper of
`strlen()` and `substr()` respectively.
@TimWolla
Copy link
Contributor Author

Marking it as deprecated is harmful because those libraries, which may have wide PHP supported bases, will start getting deprecation warnings on PHP 8 and then scramble to update their code in less secure ways.

Understood. I'm taking your reply as “please drop the commit marking the deprecation, the other two commits are okay” and just pushed that change.

I hope the PR is good now 🤞

@paragonie-security paragonie-security merged commit c8b7efb into paragonie:master Sep 22, 2025
14 checks passed
@TimWolla
Copy link
Contributor Author

See facebookarchive/php-graph-sdk#552 (comment)

And yes, I am aware. That's why I called the INI setting a “misfeature” in my PR description 😄

Thank you!

@TimWolla TimWolla deleted the func-overload-is-no-more branch September 22, 2025 20:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants