Undesirable side-effects of is_callable() use

[laravel]

Undesirable side-effects of is_callable() use

[driesvints]

Hey @lupinitylabs. I feel like this isn't really dangerous as it's up to the developer to sanitise an input for the field method. Of course, you're welcome to attempt the PR to see what Taylor thinks. Thanks

[lupinitylabs]

How would you sanitize this? The only possibility I would see is to check using is_callable() during validation if the value you try to put there is actually callable, and then filter it out...

Besides this, I feel that it is a bit of a nuisance to have to try to come up with field titles that are not function names... 😕

[driesvints]

Isn't $attachment->field('dd', 'Whoops') userland code? Just don't pass dd as an argument there?

[lupinitylabs]

I can imagine several occasions where you send a slack message to a user where the user might be able to define the titles of the attachment fields. So, from my point of view, either this is flagged as something bad, and you should never use attachments even with escaped and sanitized user-provided data (then there should probably be a warning in the docs), or measures should be taken that these unexpected side-effects are not occurring? 🤔

[driesvints]

I personally don't see a situation where a user would ever fill this out themselves but if you do feel free to attempt a PR to improve this 👍