vimeo/psalm
Voir sur GitHubTaint analysis: support conditional escaping for class methods
Open
#5 053 ouverte le 19 janv. 2021
Help wantedbugtaint analysis
Métriques du dépôt
- Stars
- (5 369 stars)
- Métriques de merge PR
- (Merge moyen 3j 12h) (5 PRs mergées en 30 j)
Description
Follow up for #4661. Works for plain functions and static methods (really great :+1:, thanks for that). Could that be implemented for non-static methods too? May be a little tricky without taint-specialize/pure?
class DB {
/**
* @psalm-taint-specialize
* @psalm-taint-escape ($type is "expression" ? null : "sql") $val
*/
public function quote(string $val, string $type): string {
return $val;
}
}
function x(PDO $p, DB $db): void {
$a = (string)$_REQUEST['a'];
$p->exec($db->quote($a, '')); // false positive
$p->exec($db->quote($a, 'expression'));
}