allow_url_fopen=1 now required to run Psalm?

[davidrans]

Upgrading from 4.8.1 to 4.9.2 introduced the following error when running psalm with allow_url_fopen=0:

▶  psalm                                                                                                  
Uncaught RuntimeException: PHP Error: DOMDocument::schemaValidate(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Config.php:707 in /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Internal/ErrorHandler.php:66
Stack trace:                                                                                                                                                                                                                                                                                                   
#0 [internal function]: Psalm\Internal\ErrorHandler::Psalm\Internal\{closure}(2, 'DOMDocument::sc...', '/mnt/ebs/home/d...', 707)
#1 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Config.php(707): DOMDocument->schemaValidate('/mnt/ebs/home/d...')
#2 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Config.php(652): Psalm\Config::validateXmlConfig('/mnt/ebs/home/d...', '<?xml version="...')                                                               
#3 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Config.php(625): Psalm\Config::loadFromXML('/mnt/ebs/home/d...', '<?xml version="...', '/mnt/ebs/home/d...', '/mnt/ebs/home/d...')                                                                                                                    
#4 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Config.php(577): Psalm\Config::loadFromXMLFile('/mnt/ebs/home/d...', '/mnt/ebs/home/d...')                                                                                                                                                            
#5 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Internal/CliUtils.php(490): Psalm\Config::getConfigForPath('/mnt/ebs/home/d...', '/mnt/ebs/home/d...')
#6 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Internal/Cli/Psalm.php(552): Psalm\Internal\CliUtils::initializeConfig(NULL, '/mnt/ebs/home/d...', 'console', Object(Composer\Autoload\ClassLoader), false)
#7 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Internal/Cli/Psalm.php(1007): Psalm\Internal\Cli\Psalm::loadConfig(NULL, '/mnt/ebs/home/d...', 'console', Object(Composer\Autoload\ClassLoader), false, Array)                                                                                        
#8 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/src/Psalm/Internal/Cli/Psalm.php(216): Psalm\Internal\Cli\Psalm::initConfig('/mnt/ebs/home/d...', Array, 'vendor', Object(Composer\Autoload\ClassLoader), NULL, 'console', false, Array)                                                                        
#9 /mnt/ebs/home/drans/Code/vendor/vimeo/psalm/psalm(4): Psalm\Internal\Cli\Psalm::run(Array)             
#10 {main}                                                                                                                                                                                                          
(Psalm 4.9.2@00c062267d6e3229d91a1939992987e2d46f2393 crashed due to an uncaught Throwable)               

Looks like this happens as part of validating the XML. Was that an intentional change?

This is what our config looks like for reference:

// psalm.xml
<?xml version="1.0"?>
<psalm
    totallyTyped="false"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="https://getpsalm.org/schema/config"
    xsi:schemaLocation="https://getpsalm.org/schema/config vendor/vimeo/psalm/config.xsd"
    errorBaseline="psalm-baseline.xml"
    autoloader="Tests/psalm-load.php"
    resolveFromConfigFile="true"
    hideExternalErrors="true"
    findUnusedVariablesAndParams="true"
>

[weirdan]

Reproduced locally. No, this was not intentional.

[weirdan]

Bisect points to this commit: bd3fd93
/cc: @turnabout

[gmessier]

It's due to #6059
To be able to include an XML file from another directory, the tags need to accept a "xml:base" attribute.
However, this attribute is in a public schema from the W3 (https://www.w3.org/2001/03/xml.xsd). PHP need to load the file, but it seems that, internally, the way it try to load it cause problems in many setups. You have the error described in this issue or some timeout error (on my side).
A possible solution is to host the xml.xsd file in the repository itself, but it's weird to have a copy of this standard schema in a repository.
Removing the feature added with 6059 it's also a problem for us as we want to reuse some configuration parts for many projects so we want to include files from other directories.

[weirdan]

Then it makes sense to ship those files as composer package(s). Perhaps somebody already does that?

[davidrans]

Anything I can do to help here? I'm happy to QA the proposed PR if that's useful