vimeo/psalm

Taint analysis: support conditional escaping for class methods

Open

#5 053 ouverte le 19 janv. 2021

Voir sur GitHub
 (4 commentaires) (1 réaction) (0 assignés)PHP (668 forks)batch import
Help wantedbugtaint analysis

Métriques du dépôt

Stars
 (5 369 stars)
Métriques de merge PR
 (Merge moyen 3j 12h) (5 PRs mergées en 30 j)

Description

Follow up for #4661. Works for plain functions and static methods (really great :+1:, thanks for that). Could that be implemented for non-static methods too? May be a little tricky without taint-specialize/pure?

class DB {
	/**
	 * @psalm-taint-specialize
	 * @psalm-taint-escape ($type is "expression" ? null : "sql") $val
	 */
	public function quote(string $val, string $type): string {
		return $val;
	}
}

function x(PDO $p, DB $db): void {
	$a = (string)$_REQUEST['a'];

	$p->exec($db->quote($a, '')); // false positive
	$p->exec($db->quote($a, 'expression'));
}

https://psalm.dev/r/06814dc3d3

Guide contributeur