Public Method Only Actions

ID

php.public_method_only_actions

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Resource

Code Smell

Language

Php

Tags

best-practice, code_smell

Description

In a front-controller MVC framework the public methods of a controller are the routable actions exposed as endpoints. This rule reports a controller’s public method that is neither a recognised action nor a framework lifecycle hook — a helper left public and therefore inadvertently reachable as a URL.

Rationale

A controller’s public surface defines its routes. Any non-action public method becomes an unintended endpoint: it widens the attack surface, can be invoked with unvalidated input, and blurs the controller’s contract. Keeping helpers private or protected makes the routable actions explicit and prevents accidental exposure.

The check follows the classic front-controller convention where action methods carry an Action name suffix (e.g. indexAction) and the dispatcher calls a small set of lifecycle hooks (init, preDispatch, postDispatch). The controller suffix, the action suffix and the lifecycle-hook whitelist are all configurable; on frameworks where every public controller method is an action (no naming suffix), disable the rule.

<?php
class UserController
{
    public function indexAction()       // OK — action method
    {
        return 'index';
    }

    public function init()              // OK — framework lifecycle hook
    {
    }

    protected function buildResponse()  // OK — non-public helper
    {
        return [];
    }

    public function helper()            // FLAW — public non-action helper is routable
    {
        return 'help';
    }
}

Remediation

If the method is a helper, change its visibility to private or protected so the dispatcher cannot route to it. If it is genuinely an endpoint, rename it to follow the action convention (for example by adding the Action suffix) so its routable nature is explicit.

References