vimeo/psalm
GitHub で見るTaint analysis: support conditional escaping for class methods
Open
#5,053 opened on 2021年1月19日
Help wantedbugtaint analysis
Repository metrics
- Stars
- (5,369 stars)
- PR merge metrics
- (平均マージ 3d 12h) (30d で 5 merged PRs)
説明
Follow up for #4661. Works for plain functions and static methods (really great :+1:, thanks for that). Could that be implemented for non-static methods too? May be a little tricky without taint-specialize/pure?
class DB {
/**
* @psalm-taint-specialize
* @psalm-taint-escape ($type is "expression" ? null : "sql") $val
*/
public function quote(string $val, string $type): string {
return $val;
}
}
function x(PDO $p, DB $db): void {
$a = (string)$_REQUEST['a'];
$p->exec($db->quote($a, '')); // false positive
$p->exec($db->quote($a, 'expression'));
}