Merge remote-tracking branch 'origin/5.x' into 4.x

src/Handler/ConsoleHandler.php

@@ -21,6 +21,7 @@ use Psalm\Type\Atomic\TBool;
 use Psalm\Type\Atomic\TInt;
 use Psalm\Type\Atomic\TNull;
 use Psalm\Type\Atomic\TString;
+use Psalm\Type\MutableUnion;
 use Psalm\Type\Union;
 use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputOption;

src/Stubs/common/Component/HttpFoundation/HeaderBag.stubphp

@@ -17,4 +17,10 @@ class HeaderBag implements \IteratorAggregate, \Countable
      * @psalm-taint-source input
      */
     public function __toString() {}
+
+    /**
+     * @psalm-taint-source input
+     * @psalm-mutation-free
+     */
+    public function get(string $key, string $default = null): ?string {}
 }

src/Stubs/common/Component/HttpFoundation/Request.stubphp

@@ -11,11 +11,9 @@ class Request
      *
      * @throws \LogicException
      *
-     * @psalm-return (
+     * @psalm-template TAsResource as bool
-     *     $asResource is true
+     * @psalm-param TAsResource $asResource
-     *     ? resource
+     * @psalm-return (TAsResource is true ? resource : string)
-     *     : string
-     * )
      */
     public function getContent($asResource = false) {}
 

src/Stubs/common/Component/HttpFoundation/Response.stubphp

@@ -13,5 +13,5 @@ class Response
      * @throws \InvalidArgumentException When the HTTP status code is not valid
      * @psalm-taint-sink html $content
      */
-    public function __construct($content = '', int $status = 200, array $headers = []) {}
+    public function __construct(?string $content = '', int $status = 200, array $headers = []) {}
 }

tests/acceptance/acceptance/AuthenticatorInterface.feature

@@ -22,19 +22,19 @@ Feature: AuthenticatorInterface
        */
       abstract class SomeAuthenticator implements AuthenticatorInterface
       {
-        public function getCredentials(Request $request)
+        public function getCredentials(Request $request): string
         {
           return '';
         }
 
-        public function getUser($credentials, UserProviderInterface $provider)
+        public function getUser($credentials, UserProviderInterface $provider): User
         {
           /** @psalm-trace $credentials */
 
           return new User('name', 'pass');
         }
 
-        public function checkCredentials($credentials, UserInterface $user)
+        public function checkCredentials($credentials, UserInterface $user): bool
         {
           /** @psalm-trace $credentials */
 
@@ -43,7 +43,7 @@ Feature: AuthenticatorInterface
           /** @psalm-trace $user */
         }
 
-        public function createAuthenticatedToken(UserInterface $user, string $providerKey)
+        public function createAuthenticatedToken(UserInterface $user, string $providerKey): PreAuthenticationGuardToken
         {
           /** @psalm-trace $user */
 

tests/acceptance/acceptance/DenormalizerInterface.feature

@@ -3,7 +3,8 @@ Feature: Denormalizer interface
   Detect DenormalizerInterface::denormalize() result type
 
   Background:
-    Given I have Symfony plugin enabled
+    Given I have issue handler "UnusedVariable,MethodSignatureMustProvideReturnType" suppressed
+    And I have Symfony plugin enabled
 
   Scenario: Psalm recognizes denormalization result as an object when a class is passed as a type
     Given I have the following code

tests/acceptance/acceptance/Tainting.feature

@@ -57,22 +57,23 @@ Feature: Tainting
       | query    |
       | cookies  |
 
-  Scenario: The user-agent is used in the body of a Response object
+#  todo: "@psalm-taint-source input" does not work on get() method
-    Given I have the following code
+#  Scenario: The user-agent is used in the body of a Response object
-      """
+#    Given I have the following code
-      class MyController
+#      """
-      {
+#      class MyController
-        public function __invoke(Request $request): Response
+#      {
-        {
+#        public function __invoke(Request $request): Response
-          return new Response($request->headers->get('user-agent'));
+#        {
-        }
+#          return new Response($request->headers->get('user-agent'));
-      }
+#        }
-      """
+#      }
-    When I run Psalm with taint analysis
+#      """
-    Then I see these errors
+#    When I run Psalm with taint analysis
-      | Type         | Message               |
+#    Then I see these errors
-      | TaintedHtml  | Detected tainted HTML |
+#      | Type         | Message               |
-    And I see no other errors
+#      | TaintedHtml  | Detected tainted HTML |
+#    And I see no other errors
 
   Scenario: All headers are printed in the body of a Response object
     Given I have the following code

tests/acceptance/acceptance/serializer/SerializerInterface.feature

@@ -3,7 +3,8 @@ Feature: Serializer interface
   Detect SerializerInterface::deserialize() result type
 
   Background:
-    Given I have Symfony plugin enabled
+    Given I have issue handler "UnusedVariable,MethodSignatureMustProvideReturnType" suppressed
+    And I have Symfony plugin enabled
 
   Scenario: Psalm recognizes deserialization result as an object when a class is passed as a type
     Given I have the following code