vimeo/psalm

Taint analysis: support conditional escaping for class methods

Open

#5053 aperta il 19 gen 2021

Vedi su GitHub
 (4 commenti) (1 reazione) (0 assegnatari)PHP (668 fork)batch import
Help wantedbugtaint analysis

Metriche repository

Star
 (5369 star)
Metriche merge PR
 (Merge medio 3g 12h) (5 PR mergiate in 30 g)

Descrizione

Follow up for #4661. Works for plain functions and static methods (really great :+1:, thanks for that). Could that be implemented for non-static methods too? May be a little tricky without taint-specialize/pure?

class DB {
	/**
	 * @psalm-taint-specialize
	 * @psalm-taint-escape ($type is "expression" ? null : "sql") $val
	 */
	public function quote(string $val, string $type): string {
		return $val;
	}
}

function x(PDO $p, DB $db): void {
	$a = (string)$_REQUEST['a'];

	$p->exec($db->quote($a, '')); // false positive
	$p->exec($db->quote($a, 'expression'));
}

https://psalm.dev/r/06814dc3d3

Guida contributor