make sure that parameters are a string when string is expected

[phil-davis]

Description

Functions like explode hash strpos strtolower expect a string as input. But sometimes the code is passing something that can be null. That is normally converted to an empty string on-the-fly by PHP. For the future, it is better to explictly cast to a string where we know this can happen "normally".

How Has This Been Tested?

CI

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Database schema changes (next release will require increase of minor version instead of patch)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:
• Changelog item, see TEMPLATE

[phil-davis]

This sort of thing was noticed by https://github.com/bohwaz in https://github.com/bohwaz/owncloud-core-php8
So I am suggesting that we adjust these that he and I have found.

[jvillafanez]

I partially disagree with the solution.
If the string could be null, then you should be able to handle that null value somehow. In a lot of scenarios, if the value is null, the behavior will be different than if the value is a string.

In general, I think it's better something like $stringValue = $value ?? '' or if ($value === null) {....} since the null value is explicitly handled the way we want.

I'd follow the same ruling I have with == vs ===: if you want to cast to a string, include a comment to explicitly say that the casting is intended and all the possible scenarios are handled the way we want.
For example, for the (string)$request->getHeader('depth') something like "the getHeader could return null so we'll consider it as an empty string", could be good enough to know that it could be null and that case is handled the way we want.

[phil-davis]

I partially disagree with the solution.

I agree with you - I have adjusted the code and the changelog...

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

71.4% Coverage
0.0% Duplication