[Bug] Some libraries seem to be searched for in wrong autoloading definition

[Idrinth]

Description

There are cases, where dependencies are found in the vendor folder of dependency guard instead of the project under test. This leads to false positives, since the symbol found is no longer found within the allowed vendor folder.

Steps to Reproduce

unknow, given project is not open sourced, so can't provide it. Will try to find a way to reproduce with purely open source code.

Edit 2018-11-24: Some more testing and comparing of the failing projects seems to suggest, that only static references(methods, properties, constants) seem to produce the result.

Expected behavior: No searching in dependency guard's vendor folder, no false positive

Actual behavior: shortened all paths, psr/log is considered unused

app-tool-installer\dependency-guard\src\Candidate\CandidateExtractor.php:34: string(67) "$vendorPath: app-service\vendor" app-tool-installer\dependency-guard\src\Candidate\CandidateExtractor.php:108: string(121) "$file: app-tool-installer\dependency-guard\vendor\psr\log\Psr\Log\LoggerInterface.php" app-tool-installer\dependency-guard\src\Candidate\CandidateExtractor.php:108: string(114) "$file: app-tool-installer\dependency-guard\vendor\psr\log\Psr\Log\LogLevel.php"

Reproduces how often: random projects, but always with the same project(s)

Versions

root package: 1.0.5 | dev-master

[janmartenjongerius]

@Idrinth as soon as you are able to successfully reproduce this, let me know if you want to take a stab at this yourself or would like support with this. I'm willing to take on this issue, but encourage any enthusiasm from the community members :wink:

[Idrinth]

@johmanx10 I'll let you know when I can replicate the issue reliably and (if time allows) write the fix. Was hoping to not being the only one with a similar issue, narrowing it down has so far not been successful. We have multiple very similar projects, with only a few producing this bug.

[Idrinth]

Some more testing and comparing of the failing projects seems to suggest, that only static references(methods, properties, constants) seem to produce the result. Will try to replicate that this weekend.