Keep the openssl cipher probe's warnings inside the probe

openssl_get_cipher_methods() reports algorithms openssl_cipher_iv_length()
rejects on PHP 8.0-8.4 (php/php-src#19994) - 40 of 248 on PHP 8.4.23 - so
the provider filters them out by probing each one, and each rejection warns.

Neither @ nor Composer's Silencer settles that: both lower what is reported,
and PHP calls a user error handler for a diagnostic regardless of
error_reporting(), so a handler that does not consult it still sees all 40.
Measured with such a handler installed: @ leaks 40, an error_reporting mask
leaks 40, a handler of our own on top of the stack leaks none.

Extracted as Internal\Silencer so the next call site does not have to
rediscover which of the three actually works.

The reported cipher list, and so the result cache key, is unchanged.

Author: SanderMuller

src/Internal/Silencer.php

@@ -0,0 +1,41 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Internal;
+
+use Closure;
+use function restore_error_handler;
+use function set_error_handler;
+
+/**
+ * Runs something that predictably emits diagnostics which are none of the user's business, and keeps
+ * them to itself.
+ *
+ * Not the `@` operator, and not Composer's `Silencer` either: both work by lowering what is reported,
+ * and PHP calls a user error handler for a diagnostic regardless of `error_reporting()`. A handler that
+ * does not consult it therefore still sees everything `@` was meant to hide, and Xdebug's `scream`
+ * disables `@` outright. A handler of our own, on top of the stack for the duration of the call, is
+ * called instead of theirs and reports nothing - and theirs is back in place afterwards.
+ *
+ * Use it only where the diagnostics are expected and meaningless, never to hide a failure that should
+ * be handled: the callable's own return value still says whether it worked.
+ */
+final class Silencer
+{
+
+	/**
+	 * @template T
+	 * @param Closure(): T $callback
+	 * @return T
+	 */
+	public static function call(Closure $callback)
+	{
+		set_error_handler(static fn (): bool => true);
+
+		try {
+			return $callback();
+		} finally {
+			restore_error_handler();
+		}
+	}
+
+}

src/Type/Php/OpenSslCipherMethodsProvider.php

@@ -4,6 +4,7 @@
 
 use PHPStan\Analyser\ResultCache\ResultCacheMetaExtension;
 use PHPStan\DependencyInjection\AutowiredService;
+use PHPStan\Internal\Silencer;
 use function array_filter;
 use function array_map;
 use function array_values;
@@ -50,10 +51,14 @@ private function getSupportedCipherMethods(): array
 			// openssl_get_cipher_methods() reports algorithms that are not actually
 			// supported on PHP 8.0-8.4 due to https://github.com/php/php-src/issues/19994
 			// Filter by actually testing each algorithm with openssl_cipher_iv_length().
-			$methods = array_values(array_filter(
+			//
+			// Probing an unsupported algorithm warns, and @ is not enough on its own: a user error
+			// handler that does not consult error_reporting() is still called for a suppressed
+			// diagnostic, and whatever installs one is out of our hands. See Silencer.
+			$methods = Silencer::call(static fn (): array => array_values(array_filter(
 				openssl_get_cipher_methods(true),
-				static fn (string $algorithm): bool => @openssl_cipher_iv_length($algorithm) !== false,
-			));
+				static fn (string $algorithm): bool => openssl_cipher_iv_length($algorithm) !== false,
+			)));
 		}
 
 		$this->supportedCipherMethods = array_map('strtolower', $methods);

tests/PHPStan/Type/Php/OpenSslCipherMethodsProviderTest.php

@@ -3,6 +3,8 @@
 namespace PHPStan\Type\Php;
 
 use PHPStan\Testing\PHPStanTestCase;
+use function restore_error_handler;
+use function set_error_handler;
 
 class OpenSslCipherMethodsProviderTest extends PHPStanTestCase
 {
@@ -28,6 +30,36 @@ public function testHashIgnoresTheOrderTheCiphersAreReportedIn(): void
 		);
 	}
 
+	/**
+	 * Reading the ciphers out of the runtime means probing each one, and on PHP 8.0-8.4
+	 * openssl_get_cipher_methods() reports algorithms openssl_cipher_iv_length() rejects with a
+	 * warning (php/php-src#19994) - 40 of 248 on PHP 8.4.23. `@` does not settle that: a user error
+	 * handler that does not consult error_reporting() is still called for a suppressed diagnostic.
+	 * See phpstan/phpstan#15176.
+	 *
+	 * Vacuous on a PHP where nothing is rejected, which is why the count is not asserted - only that
+	 * whatever the probe does stays inside it.
+	 */
+	public function testProbingTheRuntimeLeaksNoWarningThroughAnUnsuppressedHandler(): void
+	{
+		$leaked = [];
+		set_error_handler(static function (int $errno, string $errstr) use (&$leaked): bool {
+			// deliberately does not check error_reporting(), so the @ operator does not hide anything
+			$leaked[] = $errstr;
+
+			return true;
+		});
+
+		try {
+			$hash = (new OpenSslCipherMethodsProvider())->getHash();
+		} finally {
+			restore_error_handler();
+		}
+
+		$this->assertSame([], $leaked, 'Probing the runtime for supported ciphers must not emit warnings.');
+		$this->assertNotSame('', $hash);
+	}
+
 	/**
 	 * @param list<string> $supportedCipherMethods
 	 */