Undocumented Error or posible dead code

[Carlos Batista]

Hello, I have found a bug that can waste a lot of time discovering it.

Explain bug

$factory = new SchemaFactory(new Psr16Cache($adapter), $container);
$factory->addControllerNamespace('MyNamespace\\Application\\')
                ->addTypeNamespace('MyNamespace\\Entity\\');

When you indicate the namespace for Entities and Controllers, and in these folders you have files that are not Entities or Controllers but a simple index.php with the following code for security reasons; If you make queries, the application does not work and no errors or messages related to this behavior are displayed:

header('Expires: Mon, 26 Jul 1997 05:00:00 GMT');
header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');

header('Cache-Control: no-store, no-cache, must-revalidate');
header('Cache-Control: post-check=0, pre-check=0', false);
header('Pragma: no-cache');

header('Location: ../');
exit;

Steps to reproduce

• In the Entities folder place a index.php file with the previous code
• do a query
• you get an empty response and you will see SyntaxError: Unexpected token '<', "<!-- begin"... is not valid JSON message on your browser extension client (ChromeiQl in this case)

Expected Behavior

During schema validation, an error should be thrown indicating that the file is not a valid class. Or you could simply ignore this file if the entities and controllers inherit or implement a specific interface with which it could be evaluated, if it is a valid class for the schema, or if it should be ignored otherwise. Perhaps this approach can also improve performance if we have entities that have not yet been completed and are ignored until we indicate that they extend or implement an EntityClass or EntityInterface.

[Jacob Thomason]

Interesting. Firstly, why would you be executing code like that in an Entity directory? I agree that this shouldn't be happening in GraphQLite. But that also looks like some codesmell.

Happy to accept a PR that addresses this issue.

[Carlos Batista]

Interesting. Firstly, why would you be executing code like that in an Entity directory? I agree that this shouldn't be happening in GraphQLite:

In reality, this code is just a complementary security measure that some applications still use and that prevents accessing the directory directly without going through the router even if the path is known. My vision about what I mentioned about indicating an interface for entities and controllers is that it allows classes from different frameworks to be integrated without distinction and avoids dealing with other classes that could be dirtying the architecture or the ideal folder structure.

[Jacob Thomason]

@cbatista8a understood. I'm not entirely sure how an implementation here would look. Performance is a consideration, of course. And I'm not sure how the PHP interpreter is going to handle loading the files and the referenced code. Reflection isn't going to be sufficient for performance reasons AFAIK.

As for security, I get where you're coming from here. Obviously your webserver shouldn't be exposing this path and that should be entirely sufficient. Nonetheless, I understand the purpose. As stated, if you can find a reasonable means of implementation, a PR is welcome.