diff --git a/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php b/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php index 2f5ae1c0b..f761a6a8e 100644 --- a/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php +++ b/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php @@ -6,6 +6,7 @@ use Psalm\CodeLocation; use Psalm\Context; use Psalm\Internal\Analyzer\Statements\ExpressionAnalyzer; use Psalm\Internal\Analyzer\StatementsAnalyzer; +use Psalm\Internal\Codebase\TaintFlowGraph; use Psalm\Internal\Codebase\VariableUseGraph; use Psalm\Internal\DataFlow\DataFlowNode; use Psalm\Issue\ImpureMethodCall; @@ -369,10 +370,20 @@ class BinaryOpAnalyzer throw new \UnexpectedValueException('bad'); } $result_type = $statements_analyzer->node_data->getType($stmt); + if (!$result_type) { + return; + } - if ($statements_analyzer->data_flow_graph - && $result_type + if ($statements_analyzer->data_flow_graph instanceof TaintFlowGraph + && $stmt instanceof PhpParser\Node\Expr\BinaryOp + && !$stmt instanceof PhpParser\Node\Expr\BinaryOp\Concat + && !$stmt instanceof PhpParser\Node\Expr\BinaryOp\Coalesce ) { + //among BinaryOp, only Concat and Coalesce can pass tainted value to the result + return; + } + + if ($statements_analyzer->data_flow_graph) { $stmt_left_type = $statements_analyzer->node_data->getType($left); $stmt_right_type = $statements_analyzer->node_data->getType($right); diff --git a/tests/TaintTest.php b/tests/TaintTest.php index f7e74b93f..5bbd74ec3 100644 --- a/tests/TaintTest.php +++ b/tests/TaintTest.php @@ -644,6 +644,12 @@ class TaintTest extends TestCase takesArray(["good" => $_GET["bad"]]);' ], + 'resultOfComparisonIsNotTainted' => [ + '