vimeo/psalm

Psalm doesn't notice session_unset()

Open

#9,198 opened on Jan 29, 2023

View on GitHub
 (2 comments) (0 reactions) (0 assignees)PHP (5,369 stars) (668 forks)batch import
Help wantedeasy problemsenhancement

Description

For example: https://psalm.dev/r/c1dc7af1fb

When the session is cleared by setting it to an empty array Psalm is aware that the key doesn't exist, but if the same is done using session_unset() Psalm doesn't notice this fact.

Contributor guide

Tech stack
None
Domain
toolingbackend
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Basic PHPSession handling
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30
Research direction
Investigate why Psalm tracks type changes when assigning an empty array to $ SESSION but not when calling session unset(). Look at Psalm's stub files for session functions in `stubs/` directory, specifically how `session unset` is defined and whether it has side effect annotations. Also examine the type inference logic in `src/Psalm/Internal/Analyzer/Statements/Expression/Call/` to see how function calls are handled. The psalm.dev example (c1dc7af1fb) demonstrates the issue. Consider adding a custom side effect handler for session unset that clears the type of $ SESSION.