Tools for Checking Magento 2 Coding Standards

Got an unofficial answer from the ECG team on that:

First of all, the flagged functions are not necessarily disallowed - they should trigger a manual review on usage to ensure legitimate use. It's a review helper tool, not good/bad code scoring tool.

Second, the assumption was it is better to use Magento wrappers (functions/classes) if they exists as they might offer additional functionality or protection.

Third, as for specific calls, base64_decode is used often for malicious injected code, and the rest like parse_str might be vulnerable, especially handling unknown or user provided input - see for example http://php-security.org/2010/05/31/mops-2010-049-php-parse_str-interruption-memory-corruption-vulnerability/

Again, this is flagging it for review not rejecting the code as bad.

Hope it helps.

You can use Magento\Framework\Filesystem\Io\File instead.

Example:

<?php

namespace Vendor\ModuleName\Model;

use Magento\Framework\Filesystem\Io\File;

class MyClass
{
   /**
    * @var File
    */
   private $file;

   /**
    * @param File $file
    */
   public function __construct(File $file)
   {
       $this->file = $file;
   }

   public function myMethod()
   {
       $path = 'this\is\some\dummy\path\potato.jpg';
       $pathInfo = $this->file->getPathInfo($path);
   }
}