'include guards' in src/Compat.php (among others) do nothing

[rsmeding-troublefree]

Recently in our codebase, I had a problem for which the best solution I could find was using two copies of the sodium_compat code (same files/version, but different paths) — I'll spare you the details, but suffice to say: we want to phase this system out, but it could take a while.

I came to the conclusion that this already nearly works. Being a polyfill, there are plenty of checks meant to prevent conflicts. However, I found that the file src/Compat.php causes the following error when included a second time:
Fatal error: Cannot declare class ParagonIE_Sodium_Compat, because the name is already in use in [application]/vendor/paragonie/sodium_compat/src/Compat.php on line 28

Attempts appear to have been made to prevent this, but:

• The file is unconditionally included from autoload.php. It uses require_once, which I suspect masks the error in regular operation, but of course this does not work when two distinct files are being included.
• The 'include guard' construct in src/Compat.php (line 24-26 in master, at the time of writing) does nothing, because the class declaration is outside of a conditional block, and is therefore hoisted above the 'early return', causing it to happen regardless.

As such, I see two possible solutions that would prevent this:

• Put an if around line 45 of autoload.php, so src/Compat.php it is only included if the ParagonIE_Sodium_Compat class has not been defined.
• Replace the 'early return' in src/Compat.php itself to put the class definition itself inside the if statement body (and of course inverting it). This prevents it from being hoisted, and makes the definition properly conditional.

I've tested both locally, and they both work. I did notice that the include in the first option was specifically written that way to fix a bug, and the second option is how the code worked previously previously already — I'm not sure what the full motivation behind either change was, so I'm not sure which solution would be better.

[paragonie-security]

This will be fixed in v1.17.2

[rsmeding-troublefree]

Thank you! Do you have a schedule for when 1.17.2 will be released? I would prefer to simply use the upstream fix/release, but if that's going to take a while, I'll have to implement a stopgap...

[paragonie-security]

The new version is actually v1.18.0 due to a new feature inclusion https://github.com/paragonie/sodium_compat/releases/tag/v1.18.0